T09 · Insecure Skill Coding Practices
Warning
- Location
references/sellersprite-api.md:10- Finding
Reusable SellerSprite Session Credentials Are Exposed to the Agent Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Amazon Deep Research V4
Security checks for vulnerabilities and agentic risk
Overview
This Amazon research skill is mostly coherent, but it asks the agent to copy and reuse logged-in SellerSprite session cookies, creating a real credential exposure risk.
Review carefully before installing. Use only if you are comfortable with browser-based research across these marketplaces, and avoid allowing the agent to copy SellerSprite cookies or tokens into prompts, logs, files, or reports. Prefer an official API key or keeping authenticated actions inside the browser session, and treat the generated HTML report as active content built from untrusted marketplace data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/html-template.md:3- Finding
Untrusted Marketplace Data May Be Injected into the Generated HTML Report
- Content
View full analysis
element ``` ```text Python directly concatenates HTML strings and embeds JSON data. Output: output/amazon-research-v4.html ``` The generated report includes externally sourced values such as product names, supplier names, keywords, image URLs, Amazon links, and 1688 offer links. ### Technical Analysis The prescribed implementation uses direct Python string concatenation to construct HTML and embeds scraped data as JSON inside an executable `script` element. The instructions do not require contextual output encoding, HTML sanitization, URL validation, or safe JSON serialization. Marketplace fields must be treated as untrusted because their content can be controlled or influenced by third-party sellers and suppliers. A malicious value containing HTML markup can escape an HTML text or attribute context. A value containing a closing script sequence can terminate an inline JSON script block and introduce executable markup or JavaScript. For example, an attacker-controlled product or supplier field containing a script-closing sequence could escape the intended JSON context if it is serialized without escaping characters significant to HTML parsing. Attribute injection is also possible if externally sourced URLs or names are directly concatenated into `href`, `src`, or other attributes. The risk is amplified because generated reports are intended to be opened in a browser and load active JavaScript through ECharts. ### Attack Path 1. An attacker publishes or modifies a product listing or supplier record on a data source que ...[truncated 1535 chars]- Remediation
View remediation
``` 7. Serialize embedded JSON safely by escaping characters that can affect HTML parsing, including `<`, `>`, `&`, U+2028, and U+2029. In particular, prevent literal script-closing sequences from appearing in an inline script block. 8. Apply a restrictive Content Security Policy. Avoid inline scripts where possible and restrict network destinations with `connect-src`, `img-src`, and `script-src`. 9. Pin third-party JavaScript to a reviewed version and use Subresource Integrity if a CDN remains necessary. 10. Add automated tests containing adversarial values in every scraped field, including quotes, HTML tags, event-handler attributes, unexpected URL schemes, and script-closing sequences. 11. Consider generating a static report without JavaScript when interactive charts are not required. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill asks for handling authenticated account cookies/tokens but provides no warning that these are sensitive credentials or that they should not be retained, shared, or output. In context, this omission is dangerous because the skill targets a manual login flow and then normalizes secret extraction as part of routine operation.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to extract and reuse authenticated session cookies from a manual login flow is a direct unsafe-secret-handling pattern. It can enable account misuse, session theft, policy violations, and unintended access to the user's paid SellerSprite account beyond the immediate research task.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs an agent to extract authentication cookies and session tokens from a logged-in browser and replay them in API calls without any safeguards, consent flow, or handling restrictions. This creates a credential-handling vulnerability because those tokens can grant full access to the user's authenticated account and may be exposed in logs, prompts, reports, or downstream tools.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document explicitly directs reuse of authenticated session artifacts (ecookie, rank-login-user, Sprite-X-Token) from an interactive login session to access protected endpoints. In this skill context, that is especially dangerous because the agent is designed for multi-platform automated collection and concurrent processing, increasing the chance of session theft, unauthorized account actions, and accidental propagation of tokens across tools or tasks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes generic phrases such as '市场调研', '快速调研', '产品分析', and '竞品分析', which are broad enough to match many ordinary research or analysis requests outside this skill’s intended Amazon product-selection workflow. The file does not provide limiting context, explicit activation constraints, or negative examples to narrow when these triggers should or should not invoke the skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the operator to extract authenticated SellerSprite session cookies and tokens from a logged-in browser and reuse them for API access. That is broader than ordinary product research and creates a credential-handling and session-hijacking risk, especially if those secrets are logged, persisted, or reused outside the original browser context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs extracting an Amazon page image URL and sending it to a third-party 1688 endpoint, but provides no user disclosure, consent step, or data-handling constraint. Even if the transmitted value is only an image URL, it is page-derived data sent cross-platform and may expose browsing targets, identifiers in signed image URLs, or commercially sensitive research activity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The fallback section says to use Chinese keywords for search, which imposes a specific language/locale behavior. Because the file does not offer opt-in, alternatives, or a clear region-specific justification, this is a natural-language policy violation under the language/locale rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file’s headings and instructions are entirely in Chinese, including operational guidance such as filtering categories and logic descriptions. There is no indication that the skill is region-specific or that users can opt into this locale, which creates a natural-language locale policy concern under the stated rules.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill description and operational instructions are written exclusively in Chinese, with no indication that users may choose another language or locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file contains user-facing operational instructions only in Chinese, which can impose a fixed language on users without opt-in. The policy allows locale constraints only when they are explicitly offered as a choice or clearly justified as region-specific, which is not stated here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill is written in Chinese and provides mandatory workflow instructions without offering any language or locale choice. This can violate a language/locale policy when users or downstream systems are not explicitly opting into Chinese-only operation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document is written entirely in Chinese and defines report labels and structure in Chinese, which indicates a fixed language/locale for generated output. There is no indication that users can opt into another language or that the template is restricted to a China-specific compliance or regional workflow.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This file contains user-facing natural-language instructions exclusively in Chinese, which can impose a language constraint on users without opt-in. Under the policy, forced language or locale without choice or justification is a natural-language policy concern.
- Content