Amazon Category Research

• Outcome: Review
• Latest audit: Jul 1, 2026 · 9:26 PM UTC
• Version: 5.1.0

Overview

The skill is mostly coherent for Amazon research, but it forces Feishu cloud document creation and local report storage even when a user may not want those outputs.

Install only if you are comfortable with the agent using an OpenClaw browser profile, reading data visible through SellerSprite/SIF, requesting Feishu authorization, creating Feishu documents under your identity, and keeping local Markdown report backups in the workspace. Review or modify the skill if you need chat-only results, no cloud export, narrower activation triggers, or explicit confirmation before each storage/export step.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to execute shell commands, read scripts, and write local Markdown files, yet those capabilities are not explicitly declared in the skill metadata. This creates a hidden-permissions problem: reviewers and policy layers may underestimate what the skill can do, while the skill also writes persistent artifacts and invokes local tooling that could expose workspace data or alter local files.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The template instructs the agent to create and update Feishu documents, introducing an external side effect that is not necessary to render an Amazon research report itself. This can cause unintended data exfiltration or unauthorized workspace modifications if the skill runs with document-tool permissions and the destination is not explicitly user-approved.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The README states that the skill saves a local Markdown backup as an authoritative copy, but it does not clearly warn users that research inputs and collected marketplace data will be written to local workspace storage. This creates a privacy and data-retention risk because users may assume the output exists only in Feishu, while sensitive research data remains on disk and could be accessed later by other tools, users, or processes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that the workflow saves a local Markdown backup in the workspace and creates a Feishu cloud document, but it does not present this as a clear upfront user warning or consent point. Because the skill collects potentially sensitive business research inputs and outputs, silent persistence to local storage and third-party cloud storage can create privacy, retention, and data-governance risks for users who may not expect dual storage.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list is extremely broad and includes generic terms like market research, product analysis, keyword research, sales analysis, and data scraping in multiple languages. That increases the chance the skill auto-activates in unrelated conversations, unnecessarily granting it browser, plugin, file, and shell-driven workflow reach in contexts where the user did not intend to invoke this high-capability skill.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill mandates creation of a Feishu cloud document and saving a full local Markdown backup regardless of user preference. This can force data egress to a third-party platform and persistent local storage even when the user only wanted an in-chat answer, expanding exposure of potentially sensitive research inputs, results, links, and workspace artifacts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The final-response policy forces Feishu-only delivery and forbids direct DM output even when the user asks for another mode. This overrides user choice and can coerce unnecessary sharing of results through an external document system, which is especially risky given the skill also requires user-identity OAuth and document creation under the user's account.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The `apply` mode writes directly to `selector_registry.py` based solely on command-line arguments, with no in-code confirmation, dry-run, backup, or validation that the new selector is safe and expected. In an agentic workflow, this can lead to silent persistence of incorrect or attacker-influenced selectors, degrading scraper integrity and potentially causing broader unintended data collection or workflow corruption.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

4. Based on the check results, automatically guide you to install/log in to plugins
5. Reply "Ready to research" once everything is set

> ⚠️ The first installation will automatically run init.py for configuration check. **For subsequent use, the Agent skips the check and goes directly to data collection.**

### Use (Daily)

• Confidence: 90% confidence
• Finding: The README directs the agent to automatically run initialization checks, skip future checks, guide plugin installation/login, and proceed directly to data collection with limited user confirmation. In this skill context, that autonomy is more dangerous because it controls a browser, interacts with authenticated extensions and Feishu, and can collect third-party marketplace data, increasing the chance of unintended actions, privacy issues, or use of stale/unsafe state.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.