Security audit

Amazon Deep Research V4

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-aligned for marketplace research, but it asks the agent to extract and reuse live SellerSprite session cookies and tokens, which puts account access at risk.

Install only if you are comfortable with the agent handling SellerSprite account session credentials. Prefer a version that uses an official API key/OAuth flow, never paste or display cookies/tokens in chat, and clear any copied session material after use. Treat generated margin or marketplace analysis as advisory, especially when live exchange rates or paid platform data are involved.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to have the user log in and then extract authenticated cookies and tokens (ecookie, rank-login-user, Sprite-X-Token) for reuse in API calls. This is dangerous because session credentials are highly sensitive secrets; extracting and replaying them can enable account takeover, unauthorized API access, and leakage of a user's authenticated session beyond the original website context.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The instruction '每次执行必须 web_search("USD CNY exchange rate today") 获取实时汇率' is a broad mandatory invocation rule without explicit user-trigger constraints or scope limits. In an agent skill, this can cause unnecessary external actions on every run, expanding data exposure, increasing prompt-injection surface from search results, and making the skill activate networked behavior even when the user did not specifically request exchange-rate lookup.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The file is written to operate in Chinese without offering user language choice, which can cause misunderstanding of financial assumptions, fees, and compliance-related outputs for users interacting in other languages. While not a direct code-execution issue, forced language can degrade user comprehension and lead to incorrect decisions in a research and margin-analysis workflow.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to extract authenticated cookies and tokens from a logged-in SellerSprite session and reuse them in later requests. Even if intended for convenience, this handles live session credentials as reusable secrets without any warning, scoping, redaction, or secure storage guidance, creating a clear risk of credential leakage, account misuse, and unauthorized API access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document explicitly instructs the user to extract live authentication artifacts from the browser (`document.cookie`) and identifies the exact cookie/token names needed to access the Sellersprite API. This is dangerous because session cookies and bearer-like tokens are credentials; exposing, copying, or reusing them outside their intended browser context can enable account takeover, unauthorized API access, and leakage of paid or sensitive marketplace data.

Ssd 3

High

Confidence: 99% confidence
Finding: This is a direct instruction to extract and reuse authenticated session cookies from a user login to access a third-party API. In security context, this is a textbook credential-handling flaw: session cookies and bearer-like tokens can grant full authenticated access, may bypass intended controls, and can be exfiltrated or reused outside the user's awareness.

Ssd 3

High

Confidence: 99% confidence
Finding: This is a direct session hijacking pattern: the agent is told to pull ecookie, rank-login-user, and Sprite-X-Token from a logged-in browser session and replay them in HTTP requests. That bypasses normal authentication boundaries and teaches the agent to convert an interactive login into transferable credentials, which could expose the user's account or violate platform access controls if those tokens are leaked or reused beyond the intended session.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.