Amazon Ops Agents

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:47 AM UTC
• Version: 1.3.0

Overview

The reviewed skill is a no-code Amazon seller strategy advisor, but its README tells users to install a different package name than the reviewed artifact.

Before installing, verify that the registry package you install is the reviewed `amazon-ops-silicon-army` package and version, or that `amazon-ops-agents` is a verified alias controlled by the same publisher. Expect Chinese-language Amazon seller advice only; do not provide marketplace credentials or rely on it for live account actions because the reviewed artifact is not designed to connect to accounts or execute changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:26
• Finding: Installation Documentation References a Different Package Identifier## Vulnerability Details **File Location**: `README.md:26` **Vulnerability Type**: Supply-chain package substitution **Risk Level**: Medium ```bash openclaw skills install amazon-ops-agents ``` The installation command references `amazon-ops-agents`, while the audited artifact consistently identifies itself as `amazon-ops-silicon-army` in `package.json`, `clawhub.yaml`, and `SKILL.md`. ### Technical Analysis Package managers resolve artifacts according to the identifier supplied by the user. Because the documented command uses a different identifier from the audited package, following the instructions can retrieve an artifact that was not included in this audit. This mismatch creates an insecure supply-chain boundary. If `amazon-ops-agents` is controlled or later compromised by another party, the installed package could contain instructions, permissions, dependencies, or executable behavior materially different from the reviewed `amazon-ops-silicon-army` package. ### Attack Path 1. An attacker publishes, takes control of, or compromises the registry entry named `amazon-ops-agents`. 2. A user follows the installation command in `README.md`. 3. The package manager resolves the mismatched identifier rather than the audited `amazon-ops-silicon-army` artifact. 4. The unreviewed package is downloaded and installed. 5. Any malicious instructions or executable components in that substituted package run subject to the permissions available to the package manager or Agent environment. ### Impact Assessment The immediate impact is installation of an unaudited artifact. The ultimate privileges and scope depend on the substituted package and the permissions granted by the installation environment. A malicious replacement could potentially influence Agent behavior, access data available to the Agent, invoke exposed tools, or execute local actions if the platform permits those capabilities. No malicious behavior was identified in ...[truncated 148 chars]
• Remediation: ## Remediation Suggestions 1. Replace the installation command with the canonical package name declared by the audited manifests: ```bash openclaw skills install amazon-ops-silicon-army@1.1.8 ``` 2. Pin installation to an immutable version and, where supported, an artifact digest or signed release. 3. Ensure the registry validates publisher identity and verifies package signatures or integrity hashes. 4. Add an automated release check that compares installation instructions against the `name` and `version` fields in `package.json` and `clawhub.yaml`. 5. If `amazon-ops-agents` is an intentional alias, document that relationship explicitly and configure a registry-level verified redirect rather than relying on two independently controlled package entries.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: Natural-language policy review applies to all file types, and this file's user-facing instructions and examples are effectively fixed to a single language. There is no indication that users may choose another language or that the Chinese-only presentation is a documented, justified regional constraint.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The README encourages invocation through very broad natural-language prompts such as generic analysis, reply drafting, and product viability questions without clearly constraining scope, required inputs, or safety boundaries. In an agent marketplace, this can cause the skill to activate on ambiguous everyday requests and be used in contexts the author did not intend, increasing the chance of over-collection of business data, unsafe advice, or unintended autonomous workflow routing.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The scenario-based activation description mixes keywords, scenes, and actions without clear invocation boundaries, so the router may match loosely related ecommerce or planning conversations. Ambiguous routing conditions are dangerous because they let the skill intrude into unrelated exchanges, increasing unintended execution of its instructions and reducing predictability of agent behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad generic terms such as ‘帮我分析/优化/制定计划/生成…/计算利润’, which are common user requests and can cause the skill to activate outside clearly intended Amazon-operations contexts. Over-broad activation increases the chance of prompt hijacking of unrelated conversations, misrouting user intent, and exposing users to domain-specific advice when they did not request this skill.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The fallback keywords ‘我要分析/帮我看/情况如何’ are extremely vague and naturally occur in ordinary conversation, making accidental activation highly likely. A vague fallback path is particularly risky because it acts as a catch-all route, overriding normal assistant behavior and enabling the skill to seize unrelated requests.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes broad single-word or short generic terms such as 'List', 'PPC', 'FBA', 'Listing', '品牌', '利润', and '库存', which can match many unrelated user requests and cause unintended skill invocation. In a business advisory skill, accidental activation can misroute user tasks, expose users to irrelevant automated guidance, and degrade trust or workflow safety, especially when the skill claims broad routing behavior.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The natural-language metadata and description are presented only in Chinese, and the manifest does not indicate that users may choose another language or locale. This can be a policy concern if the skill implicitly constrains interaction language without opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The package description uses Chinese-language text exclusively, which may impose a language expectation on users without any stated opt-in or documented region-specific justification. Under the policy rule for language/locale constraints, this can be treated as a natural-language policy issue when no user choice is offered.

Static analysis

No suspicious patterns detected.