Amazon Listing Image Optimizer

• Analyzed: May 11, 2026, 4:56 AM
• Findings: 1
• Version: 1.0.0
• Hash: bef9be6dcb012e64da27368fa83caeb9f95cbf97de0010a45806c97e6f757899
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a significant path traversal vulnerability in `scripts/push_images.js`. This script starts a local HTTP server on a publicly accessible port (`0.0.0.0:8899`) to serve images to Amazon's crawlers. The server's file path construction (`path.join(dir, req.url.replace(/^//, ''))`) is vulnerable to path traversal, potentially allowing an attacker to read arbitrary files from the host system if the server's IP and port are discovered. While the public server is plausibly needed for the stated purpose, this vulnerability, combined with the broad network exposure, poses a high risk of information disclosure. The skill also handles sensitive Amazon SP-API credentials and makes external network calls, but these actions are aligned with its stated purpose and lack clear malicious intent.