Security audit

Amazon Category Research

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised Amazon research, but it also forces cloud-document upload/full Feishu authorization and includes unsafe persistent selector-repair behavior.

Review this carefully before installing. Only use it if you are comfortable granting Feishu authorization, storing full research reports locally, and having reports uploaded to Feishu. Do not use it for confidential product strategy unless Feishu retention and sharing are acceptable. The selector self-healing feature should be disabled or restricted to reviewed maintainer changes before use in a production agent environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:36
Finding: Forced Third-Party Report Upload Overrides Explicit User Refusal
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:47
Finding: Mandatory Full-Scope Feishu OAuth Authorization Violates Least Privilege
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/healer.py:143
Finding: Unescaped Selector Repair Enables Persistent Python and Browser JavaScript Injection
Content: View full analysis
bool: """将修复的选择器写入 selectors.py""" with open(SELECTORS_PATH, "r") as f: content = f.read() # 找到对应字段的 primary 选择器行 pattern = rf'("{field_id}":\s*\{{[^}}]*?"primary":\s*)"([^"]*)"' match = re.search(pattern, content) if not match: return False old_selector = match.group(2) # 把旧 primary 加到 fallbacks 首位，新选择器替换 primary new_content = content[:match.start()] + match.group(1) + f'"{new_selector}"' + content[match.end():] # 把旧 primary 加入 fallbacks（插入到第一个 fallback 之前） fallback_pattern = rf'("{field_id}":\s*\{{[^}}]*?"fallbacks":\s*\[)"([^"]*)"' fb_match = re.search(fallback_pattern, new_content) if fb_match and old_selector: insert_pos = fb_match.end(1) new_content = new_content[:insert_pos] + f'"{old_selector}", ' + new_content[insert_pos:] with open(SELECTORS_PATH, "w") as f: f.write(new_content) ``` The modified file is subsequently imported by generator and parser scripts. For example, `scripts/gen_product.py` imports the registry and interpolates selector values directly into generated JavaScript: ```python from selector_registry import FIELDS def _gen_try_block(field_id: str, cfg: dict) -> str: extract = cfg["extract"] primary = cfg["primary"] fallbacks = cfg.get("fallbacks", []) if extract == "__QA__": lines = [] lines.append(f' try {{ r["{field_id}"] = (() => {{') lines.append(f' const qa = document.querySelectorAll("{primary}");') lines = [] lines.append(f' try {{ r["{field_id}"] = (( ...[truncated 4394 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior materially exceeds the stated purpose by including scraper-maintenance and self-modifying extraction logic such as diagnostic JS generation and selector repair. That mismatch is dangerous because it obscures operational risk and makes it harder for users and policy systems to understand that the skill can alter local scraping logic and run maintenance workflows beyond simple market research.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior materially exceeds the stated purpose by including scraper-maintenance and self-modifying extraction logic such as diagnostic JS generation and selector repair. That mismatch is dangerous because it obscures operational risk and makes it harder for users and policy systems to understand that the skill can alter local scraping logic and run maintenance workflows beyond simple market research.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: The README states that the first installation automatically runs initialization checks and that later use skips checks and goes directly to data collection. This enables the agent to take actions and collect data without a fresh confirmation of readiness, authorization state, or user intent, increasing the chance of unauthorized browsing, plugin use, or data processing under stale assumptions.
Content: Scanner excerpt · README.en.md (reported line 75)May include surrounding context.
md
4. Based on the check results, automatically guide you to install/log in to plugins 5. Reply "Ready to research" once everything is set > ⚠️ The first installation will automatically run init.py for configuration check. **For subsequent use, the Agent skips the check and goes directly to data collection.** ### Use (Daily)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly says it will save a local Markdown backup and create a Feishu cloud document, but the README does not clearly warn users that collected marketplace data and analysis outputs will be written both to local workspace storage and to a third-party cloud service. This can lead to unintended disclosure, retention, or compliance issues, especially if reports contain sensitive research, account-linked data, or proprietary business intelligence.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs use of shell execution and local file read/write behaviors but does not declare a corresponding tool scope or permission boundary. This creates hidden capability expansion: an invoking user or reviewer may believe the skill is limited to browser-based Amazon research, while it can also execute scripts and persist data locally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list is extremely broad and includes generic commerce and research terms, increasing the chance of accidental invocation in unrelated conversations. In this skill's context, accidental invocation matters because it can lead to browser automation, plugin inspection, local file creation, and Feishu export being initiated for users who did not clearly request those actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mandates Feishu OAuth and document-writing as part of the workflow, even when the core user need is Amazon research. Coupling unrelated external account authorization and remote document creation to the main task increases data exposure risk, especially because collected research data, links, and analysis are automatically persisted to a third-party platform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill mandates both local backup creation and remote Feishu document persistence without an explicit user-facing warning or consent step. This is especially risky in an Amazon seller-research context because the generated reports may contain sensitive market strategy, product ideas, and competitive intelligence that users may not expect to be stored in multiple places.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill requires persistent local Markdown backups and mandatory external document creation without making data retention a first-class, opt-in part of the skill contract. This is dangerous because research inputs may contain commercially sensitive product ideas, keywords, or competitive analyses that are silently stored locally and transmitted to Feishu.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file is entirely written as Chinese input/output examples, including the title and all example fields, which implies the skill expects or produces Chinese-language content by default. There is no visible opt-in, alternative language option, or justification that the skill is limited to a Chinese-language or region-specific workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document title and the entire template are written in Chinese, which implies the skill output is expected in a specific language by default. The file does not indicate that users may choose another language or locale, so this constitutes a natural-language locale constraint without opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template instructs the agent to create and update Feishu documents, which expands behavior beyond Amazon category research into external side effects. Even though this is framed as output handling, it can cause unauthorized data exfiltration or unapproved third-party actions if the skill is invoked in environments where document APIs are available.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language documentation and usage description are entirely in Chinese, indicating a fixed language choice for the skill/script without any opt-in or alternative locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level docstring and CLI usage/help text are written in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly calls for flagging language or locale constraints when the skill does not offer user choice or clearly justify the restriction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script can directly rewrite the selector registry on disk via apply_fix, which goes beyond passive research/analysis and introduces an integrity risk to the skill codebase. In an agentic workflow, a bad diagnosis result or manipulated input could cause persistent selector corruption and change future scraping behavior without human review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: apply_fix performs an immediate overwrite of the selector registry with no runtime warning, confirmation, backup, or transaction safety. In an automated agent setting, this increases the chance that malformed or adversarial inputs cause silent persistent changes, making the research pipeline unreliable and harder to audit.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Exposing a CLI mode that applies arbitrary selector updates enables code/configuration rewriting that is not necessary for simple Amazon category research. If this command is reachable by an agent or automation pipeline, untrusted inputs can be converted into persistent changes that alter future extraction logic or break the tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The generated browser-evaluated JavaScript collects the current page URL and DOM text snippets from detected browser extension containers, then returns them to the calling agent. Even though this is framed as a setup check, those snippets may contain sensitive account, product, or extension-derived data, and there is no minimization, consent prompt, or clear disclosure before collection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring, usage instructions, and environment notes are presented exclusively in Chinese, and the same pattern continues in user-facing help text. This creates a language-policy issue because the skill effectively forces one language for operation guidance without opt-in or a stated region-specific justification.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/run_all.py (reported line 45)May include surrounding context.
python
script_path = os.path.join(SCRIPT_DIR, script_name) if not os.path.exists(script_path): return "" r = subprocess.run( [sys.executable, script_path], capture_output=True, text=True )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Exceptions, usage output, and status/error messages such as execution failures and missing-argument notices are all hardcoded in Chinese. Because these are the strings users see during operation, the file enforces a single language without opt-in or an explicit, justified locale restriction.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/run_all.py (reported line 86)May include surrounding context.
python
cmd = [sys.executable, script_path] if args: cmd.extend(args) r = subprocess.run(cmd, capture_output=True, text=True) if r.returncode != 0: raise RuntimeError(f"{script_name} 执行失败: {r.stderr.strip() or '未知错误'}") return r.stdout.strip()

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring is entirely in Chinese and the regex extraction logic later in the file is hard-coded to Chinese labels, indicating the skill is designed around a single language/locale. The policy allows locale constraints only when the choice is offered to the user or the constraint is clearly documented and justified; neither is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Both SPIRIT_PATTERNS and SIF_PATTERNS depend on Chinese strings such as '品牌', '卖家', and '流量词' to parse data. This enforces a specific language/locale behavior without any visible user choice or explanation that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document presents Chinese as the default content and only offers English via a link, while explicitly labeling the current page as 中文. This creates a language/locale preference in the skill description without clear opt-in or an explanation that the skill is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.