astrmap-voc

• Outcome: Pass
• Latest audit: Aug 22, 2026 · 7:18 AM UTC
• Version: 1.0.5

Overview

This skill is a disclosed AstrMap API helper for Amazon review collection and analysis, with expected external API, API key, desktop-client, and credit-use behavior documented.

Install only if you trust AstrMap with the Amazon review/product data and the AstrMap API key you provide. Use a dedicated non-business Amazon buyer account in the desktop client, confirm before any create/incremental/analysis-trigger action that may consume credits or use the linked desktop endpoint, and prefer tightening the requests dependency before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill requires access to an environment variable containing an API key and performs outbound network calls to a fixed external service, but it does not declare explicit permissions for those capabilities. This creates a transparency and policy-enforcement gap: users and platforms may not realize the skill can access secrets and exfiltrate them over the network, increasing the risk of unintended secret disclosure or overbroad execution trust.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation includes the live API key format (`sk_live_...`) and shows how credentials are passed, but it does not warn users not to embed keys in client-side code, share them in screenshots, or log Authorization headers. In a skill that is intended for agent/API integrations, this omission increases the chance of credential leakage and misuse of a live account.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document states that task creation dispatches work to a bound desktop endpoint and later requires a logged-in Amazon buyer account, but it does not clearly warn that API calls can cause actions on a user-controlled device and consume or affect a linked third-party account session. In this context, hidden side effects on an endpoint and external account increase the risk of unintended automation, account misuse, and operational abuse if integrators trigger actions without informed consent or safeguards.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This client sends user-supplied task content, task identifiers, and review/query parameters to a third-party service over the network, but the executable interface provides no explicit disclosure, consent prompt, or data-handling warning. In an agent setting, that can cause users to unknowingly transmit product URLs, review corpora, or business intelligence to an external vendor.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            response = requests.post(url, json=data or {}, headers=headers, timeout=30)
            response.raise_for_status()
            result = response.json()
            if result.get("code") != 0:

• Confidence: 87% confidence
• Finding: The code performs authenticated external POST requests containing user-provided inputs and retrieved analysis parameters to a remote API. External transmission is expected for an API client, but it remains security-relevant because users may not realize their data leaves the local environment and because all trust is placed in the remote service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 97% confidence
• Finding: The dependency is specified as `requests>=2.28.0`, which is unpinned and permits installation of a wide range of versions depending on resolver state and environment. This weakens supply-chain control and reproducibility, and in this specific case it also allows environments to resolve to vulnerable 2.28.x versions unless an explicit safe minimum or exact version range is enforced.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Although the file does not explicitly pin `requests==2.28.0`, the declared range `requests>=2.28.0` includes 2.28.0 and other potentially vulnerable versions, so the vulnerable dependency finding is materially valid in practice. If the environment resolves to an affected release, known Requests flaws such as credential leakage or TLS/session verification issues could expose secrets or enable insecure network interactions in a skill likely to fetch external e-commerce data.

Static analysis

No suspicious patterns detected.