Skill Amazon Ads Optimizer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:39 AM UTC
• Version: 1.0.0

Overview

This Amazon Ads skill mostly does what it says, but it asks users to store durable ad-account credentials in a local plaintext file without adequate safety guidance or containment.

Review before installing. Use a dedicated least-privilege Amazon Ads app/token, keep the credentials file outside repositories and shared workspaces, set restrictive file permissions, add it to .gitignore, and rotate the token if it may have been exposed. Treat campaign exports as sensitive business data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ads.js:12

Finding

Long-Lived Amazon Credentials Stored in an Unprotected Plaintext File

Content

View full analysis

Vulnerability Details

File Location: scripts/ads.js:12-16; related setup instructions in SKILL.md:15-24 and README.md:22-31
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code

js

const CREDS_PATH = process.env.AMAZON_ADS_PATH || './amazon-ads-api.json';

const ENDPOINTS = { na: 'advertising-api.amazon.com', eu: 'advertising-api-eu.amazon.com', fe: 'advertising-api-fe.amazon.com' };

function getCreds() { return JSON.parse(fs.readFileSync(CREDS_PATH, 'utf8')); }

The documented credential file contains the following long-lived secrets:

json

{
  "lwaClientId": "amzn1.application-oa2-client.YOUR_CLIENT_ID",
  "lwaClientSecret": "YOUR_CLIENT_SECRET",
  "refreshToken": "Atzr|YOUR_REFRESH_TOKEN",
  "profileId": "YOUR_ADS_PROFILE_ID",
  "region": "eu"
}

Technical Analysis

The Skill requires users to save an Amazon Login with Amazon client secret and refresh token in a plaintext JSON file. By default, that file is expected in the current project directory as ./amazon-ads-api.json.

Neither the implementation nor the documentation enforces or recommends restrictive file permissions, storage outside the repository, use of a secret manager, or exclusion from version control. The project also does not include a .gitignore rule protecting the documented filename.

A refresh token is a long-lived credential that can be exchanged for access tokens. Consequently, exposure of this file is materially more serious than exposure of a short-lived access token. The code does not itself transmit these credentials to an unauthorized party: it sends them to Amazon's official HTTPS OAuth endpoint, which is necessary for the declared functionality. The weakness is the local storage and handling model.

Attack Path

1. A user follows the setup instructions and creates amazon-ads-api.json in the project or working directory.
2. The file inhe ...[truncated 1346 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system credential store, managed secret service, or protected environment variables over a project-local JSON file.
2. If file-based credentials must remain supported:
   • Require the file to be outside the repository by default.
   • Reject files whose permissions allow group or world access on supported platforms.
   • Recommend and enforce mode 0600 where practical.
   • Resolve the path explicitly and reject unexpected file types such as symbolic links if the execution environment is not trusted.
3. Add amazon-ads-api.json and common credential filename variants to .gitignore.
4. Update README.md and SKILL.md with explicit warnings against committing, logging, sharing, or backing up the credential file insecurely.
5. Document credential revocation and rotation procedures.
6. Configure the Amazon application and refresh token with only the minimum API permissions required to list profiles and campaigns.
7. Avoid including token endpoint response bodies in errors where they might contain sensitive diagnostic data; return a sanitized error code and message instead.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/ads.js:125

Finding

Module Import Unconditionally Executes CLI Control Flow

Content

View full analysis

Vulnerability Details

File Location: scripts/ads.js:125-126
Vulnerability Type: Import-time side effects and unintended network execution
Risk Level: Low

Vulnerable Code

js

main().catch(e => { console.error(e.message || e); process.exit(1); });
module.exports = { getProfiles, getCampaigns, getAccessToken };

Relevant command processing invoked by main() includes:

js

async function main() {
  const args = parseArgs();
  if (!args.command) {
    console.log('Usage:');
    console.log('  node ads.js --profiles');
    console.log('  node ads.js --campaigns [--out file.json]');
    console.log('  node ads.js --summary');
    process.exit(0);
  }

Technical Analysis

The file exports reusable functions through module.exports, but it also calls main() unconditionally. Node.js executes top-level statements when a module is loaded with require(). Therefore, importing this module triggers CLI argument parsing and may terminate the entire host process or initiate credential reads and Amazon API requests.

This violates the expected separation between reusable library behavior and executable CLI behavior. The issue is especially relevant in an agent host, test runner, or larger automation process where importing the advertised functions should not execute unrelated control flow.

The reachable network destinations remain hard-coded official Amazon HTTPS endpoints. No attacker-selected destination or remote code execution was identified.

Attack Path

1. Another component imports scripts/ads.js to call one of the exported functions.
2. Node.js evaluates the module and immediately invokes main().
3. If no recognized command is present, main() invokes process.exit(0), terminating the importing process.
4. Alternatively, if the host process arguments contain --profiles, --campaigns, or --summary, the imported module reads the configured credential file.

...[truncated 1034 chars]

Remediation

View remediation

Remediation Suggestions

Guard CLI execution so it occurs only when the script is launched directly:

js

if (require.main === module) {
  main().catch(e => {
    console.error(e.message || e);
    process.exitCode = 1;
  });
}

module.exports = { getProfiles, getCampaigns, getAccessToken };

In addition:

1. Avoid calling process.exit() inside reusable control flow; set process.exitCode or return an explicit status instead.
2. Separate CLI parsing into a dedicated entry-point file and keep API functions in a side-effect-free module.
3. Add tests confirming that importing the module performs no filesystem access, network requests, console output, file writes, or process termination.
4. Validate that --out has a following value and document that it writes potentially sensitive campaign information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description is partially accurate: the script does list profiles and show campaign/budget summaries for Amazon Ads Sponsored Products. However, it overstates the functionality in material ways. There is no campaign management capability implemented, only a POST to /sp/campaigns/list and a profiles fetch. The reported 'performance' is not actual ad performance data; the script only summarizes campaign states and daily budgets from campaign metadata. Additionally, operation is tied to configured credentials and a profileId in a local JSON file, so 'works with any advertiser account' is broader than what the code demonstrates. The file output capability is a supporting detail, not a mismatch by itself.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

node scripts/ads.js --profiles

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

node scripts/ads.js --profiles

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

node scripts/ads.js --profiles

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

node scripts/ads.js --profiles

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

node scripts/ads.js --profiles

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

node scripts/ads.js --profiles

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to place long-lived Amazon Ads credentials, including client secret and refresh token, in a local JSON file without any warning about secure storage, exclusion from source control, or file permission hardening. In an agent-skill context, this increases the chance of accidental credential exposure through commits, logs, workspace sharing, or multi-agent access, which could enable unauthorized access to Amazon Ads accounts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior requires environment access and outbound network calls. In an agent setting, missing scope declarations can cause overbroad execution privileges, making it harder to constrain or audit access to secrets and external APIs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup instructs users to store high-value credentials, including client secret and refresh token, in a local JSON file and reference it via an environment variable path without warning about secret-handling risks. This increases the chance of accidental exposure through source control, weak filesystem permissions, backups, logs, or misconfigured shared environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ads.js (reported line 25)May include surrounding context.

js

async function getAccessToken() {
  const creds = getCreds();
  const res = await fetch('https://api.amazon.com/auth/o2/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ads.js (reported line 25)May include surrounding context.

js

async function getAccessToken() {
  const creds = getCreds();
  const res = await fetch('https://api.amazon.com/auth/o2/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/ads.js:12

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/ads.js:32