ClawHub
Back to skill

Security audit

Amazon Ads Reporter

Security checks for vulnerabilities and agentic risk

Overview

This skill reads user-provided Amazon Ads credentials to generate Amazon advertising reports and bid listings, with no evidence of hidden execution, persistence, or non-Amazon data transfer.

Install only if you intend to let the skill use your Amazon Ads API credentials. Keep the credential JSON protected, set AMAZON_ADS_PATH deliberately if you do not want the default ~/amazon-ads-api.json path used, and be aware that some documented campaign-level commands reference scripts not included in this artifact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Ae1

High
Category
analysis-evasion
Content
node scripts/keyword-report.js
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/get-bids.js
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/get-bids.js
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
Node.js built-ins only (`https`, `zlib`, `fs`, `path`). No npm install required.

## Notes
- Access tokens expire — refresh via Amazon Login with Advertising if needed
- The `GZIP_JSON` format is gunzipped automatically by poll-report.js
- Reports are only available for the previous day and earlier (endDate = yesterday)
- `get-bids.js` uses the live v3 keyword list endpoint — no async report needed, instant response
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Transmission

Medium
Category
Data Exfiltration
Content
async function getAccessToken() {
  const creds = getCreds();
  const res = await fetch('https://api.amazon.com/auth/o2/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
async function getAccessToken() {
  const creds = getCreds();
  const res = await fetch('https://api.amazon.com/auth/o2/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low
Confidence
97% confidence
Finding
The inline comment at L114 says winning keywords are those with clicks > 0 OR impressions >= 50, but the module header documentation at L004 states impressions > 50. The code implements >= 50 at L115, so one of the documented intent statements is inaccurate and actively contradicts actual behavior at the threshold boundary.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/keyword-report.js:9

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/keyword-report.js:23