T08 · Insecure Dependencies
Warning
- Location
README.md:20- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Amazon Spapi
Security checks for vulnerabilities and agentic risk
Overview
This Amazon seller automation skill appears purpose-aligned, but needs review because it handles reusable seller credentials, exports sensitive commerce data, and can change live listing prices without strong safeguards.
Review before installing. Use a dedicated workspace, pin and lock the `amazon-sp-api` dependency, grant the Amazon app only the roles needed, keep the credential file private with owner-only permissions, avoid committing it, treat `--out` files and command output as sensitive, and run price updates only when you intend to change live marketplace listings.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/orders.js:54- Finding
Sensitive API Results Exported Without Explicit Access Controls
- Content
View full analysis
({ orderId: o.AmazonOrderId, status: o.OrderStatus, total: `${o.OrderTotal?.Amount} ${o.OrderTotal?.CurrencyCode}`, date: o.PurchaseDate, })); console.log(`\nFound ${summary.length} orders (last ${args.days} days):\n`); summary.forEach(o => console.log(` ${o.orderId} | ${o.status} | ${o.total} | ${o.date?.slice(0, 10)}`)); if (args.out) fs.writeFileSync(args.out, JSON.stringify({ fetchedAt: new Date().toISOString(), count: summary.length, orders: summary }, null, 2)); return summary; } if (args.command === 'get') { const order = await getOrder(args.orderId); const items = await getOrderItems(args.orderId); const result = { order, items }; console.log(JSON.stringify(result, null, 2)); if (args.out) fs.writeFileSync(args.out, JSON.stringify(result, null, 2)); return result; } ``` `scripts/inventory.js:36-47`: ```js async function main() { const args = parseArgs(); const inventory = await getInventory(args.sku); console.log(`\nInventory (${inventory.length} SKUs):\n`); inventory.forEach(item => { const qty = item.inventoryDetails?.fulfillableQuantity ?? item.totalQuantity ?? 'N/A'; console.log(` ${item.sellerSku} | ASIN: ${item.asin} | Fulfillable: ${qty} | Condition: ${item.condition}`); }); if (args.out) { fs.writeFileSync(args.out, JSON.stringify({ fetchedAt: new Date().toISOString(), count: inventory.length, inventory }, null, 2)); console.log(`\nSaved to ${args.out}`); } } ``` `scripts/listings.js:67-75`: ```js if (args.command === 'get') { const listing = await getList ...[truncated 3799 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad Amazon SP-API skill for operational seller workflows such as orders, inventory, listings, and pricing. The supplied code chunk does not implement any of those functions. Its actual purpose is authentication/client setup plus a connectivity test that lists seller marketplace participations. While this is related to Amazon SP-API access, it is materially narrower than the declared behavior. There are no unrelated malicious capabilities evident, but the advertised operational capabilities are not represented in this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code only implements one subset of the declared functionality: checking FBA inventory through the SP-API getInventorySummaries operation. It does not fetch orders, manage listings, or manage pricing in the supplied chunk. The marketplace/account aspect is partially consistent because it uses configured marketplace/auth data, but the primary behavior here is much narrower than the declared broad skill description. This is a description-to-behavior mismatch because the declared purpose overstates the implemented capabilities in the provided code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The supplied code does interact with Amazon SP-API and is consistent with the listings/pricing portion of the description, but it does not implement order retrieval or FBA inventory checks mentioned in the declared purpose. Its concrete behavior is limited to getListingsItem and patchListingsItem on a configured seller account and marketplace. Therefore the description overstates the implemented capabilities and scope for this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code chunk is narrowly focused on the Orders API. It parses CLI arguments for listing orders or getting one order, calls getOrders/getOrder/getOrderItems, prints results, and optionally writes them to a file. There is no code for FBA inventory, listings, or pricing operations, so the declared description materially overstates the implemented capabilities. While using a configured marketplace is consistent with Amazon SP-API usage, the claim that it works with any marketplace and seller account is broader than what this code chunk itself demonstrates.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `orders.js` — Orders
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `orders.js` — Orders
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `orders.js` — Orders
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `orders.js` — Orders
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `orders.js` — Orders
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `orders.js` — Orders
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `inventory.js` — FBA Inventory
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `inventory.js` — FBA Inventory
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `inventory.js` — FBA Inventory
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### `inventory.js` — FBA Inventory
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to create a plaintext credential file containing an SP-API client secret and refresh token, but provides no warning to keep it out of version control or restrict file permissions. In an agent-skill context, this is dangerous because users may copy the example verbatim, commit secrets, or leave them readable on shared systems, leading to compromise of the seller account and API access.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill declares no explicit tool scope or permissions, yet it clearly depends on environment configuration and local credential file access via the AMAZON_SPAPI_PATH variable. In an agent ecosystem, missing scope declarations can cause the runtime to grant broader-than-expected access or make operators unaware that the skill reads sensitive secrets from the environment/filesystem.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## Notes - Tokens auto-refresh via LWA — no manual management - Keep credential files at `chmod 600` - Respect SP-API rate limits per endpoint ## Related
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script writes Amazon order summaries to an arbitrary user-supplied path with no warning or safeguards, and order metadata can still be sensitive business data. In an agent skill context, this increases the chance that customer/order information is silently persisted to insecure locations, shared workspaces, or logs where retention and access controls are weaker than the SP-API source system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This path writes full order and item details directly to disk, which may include more sensitive data than the summary view, such as product, fulfillment, and potentially customer-associated order details. In the context of an Amazon SP-API skill, silently persisting this data creates a realistic confidentiality risk if the file is written to a broadly accessible path or retained longer than intended.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The usage examples include exporting order and inventory data to JSON files and updating listing prices, both of which can affect user data or business operations. The README does not include any caution that these commands write files locally or that the update action changes live marketplace data.
- Content
Static analysis
No suspicious patterns detected.