Security audit

Skill Amazon Review Request

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised Amazon review-request workflow, but it can automatically send order metadata to a Supabase endpoint that is not clearly disclosed in the user-facing instructions.

Review this carefully before installing. Use it only if you are comfortable granting Amazon SP-API Messaging access and exposing order-processing metadata to a Supabase project whenever a Supabase config file exists. Avoid scheduling it until the Supabase behavior is explicitly documented, opt-in, and scoped to a trusted endpoint and least-privilege key.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/request-reviews.js:53
Finding: Undisclosed Automatic Transmission of Amazon Order Metadata to a Configurable Supabase Endpoint
Content: View full analysis
{ const body = JSON.stringify(row); const req = require('https').request({ hostname: apiUrl.hostname, path: apiUrl.pathname + apiUrl.search, method: 'POST', headers: { apikey: key, Authorization: `Bearer ${key}`, 'Content-Type': 'application/json', Prefer: 'return=minimal', 'Content-Length': Buffer.byteLength(body), }, }, (res) => { res.resume(); resolve(res.statusCode); }); req.on('error', () => resolve(null)); req.write(body); req.end(); }); } async function supabaseAlreadySent(orderId) { if (!supabaseCfg) return false; const { url, key } = supabaseCfg; const apiUrl = new URL(`/rest/v1/review_requests?order_id=eq.${orderId}&status=eq.sent&select=order_id`, url); return new Promise((resolve) => { const req = require('https').request({ hostname: apiUrl.hostname, path: apiUrl.pathname + apiUrl.search, method: 'GET', headers: { apikey: key, Authorization: `Bearer ${key}`, Accept: 'application/json', }, ...[truncated 4440 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/request-reviews.js (reported line 194)May include surrounding context.
js
}); } // ── SP-API: access token ───────────────────────────────────────────────────── async function getAccessToken() { const body = new URLSearchParams({ grant_type: 'refresh_token',

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/request-reviews.js (reported line 299)May include surrounding context.
js
}); } // ── SP-API: access token ───────────────────────────────────────────────────── async function getAccessToken() { const body = new URLSearchParams({ grant_type: 'refresh_token',

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/request-reviews.js (reported line 300)May include surrounding context.
js
}); } // ── SP-API: access token ───────────────────────────────────────────────────── async function getAccessToken() { const body = new URLSearchParams({ grant_type: 'refresh_token',

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/request-reviews.js (reported line 302)May include surrounding context.
js
// Get access token log('Fetching access token…'); const accessToken = await getAccessToken(); log('Access token obtained.'); // Fetch orders log(`Fetching Shipped orders (last ${ELIGIBILITY_MAX_DAYS} days)…`);

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script’s stated purpose is Amazon review-request automation, but it also loads separate Supabase credentials from the user’s home directory and performs independent database reads and writes. That expands the skill’s trust boundary and data-access scope beyond the apparent purpose, creating unnecessary exposure of another service account and a second exfiltration/persistence channel if the script is modified or compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 31% confidence
Finding: The heading labels the document as an internal ops context, but it does not contain any explicit language or locale mandate. Because the policy category only covers clear language or locale violations, this does not rise to a confident finding.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/request-reviews.js:200