Security audit

SP-API Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says for Amazon seller operations, but it includes live listing price changes with weak safeguards and handles sensitive seller data and credentials.

Review this before installing if the credentials can modify listings. Use least-privilege SP-API credentials, avoid enabling listing-write permission unless needed, pin and lock the npm dependency, store credentials with restrictive permissions, keep exports in a private directory, and do not run price updates without an external confirmation or dry-run process.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/orders.js:64
Finding: Sensitive Seller Data Written Through Unrestricted Output Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/listings.js:36
Finding: Insufficient Validation and Confirmation for Live Price Updates
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a broad SP-API skill for operational seller tasks such as orders, inventory, listings, and pricing across marketplaces. This code chunk does not implement those capabilities. Instead, it provides authentication helpers and a connectivity test that lists marketplace participations for the configured seller account. While this may be a supporting component of such a skill, the supplied code's actual purpose is materially narrower than the declared description, so the description does not accurately represent this chunk on its own.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a broader multi-capability Amazon SP-API skill, but the supplied code only implements FBA inventory retrieval. It does not fetch orders, manage listings, or manage pricing in this chunk. Its actual behavior is specifically calling the FBA Inventory endpoint, displaying inventory summaries, and optionally exporting results to a local JSON file. While checking FBA inventory is consistent with part of the description, the declared description materially overstates what this code chunk does, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied code is narrowly focused on the Orders API. It supports listing orders, retrieving a single order, and retrieving order items, plus optional file output. The description claims a broader multi-function SP-API skill that also checks FBA inventory and manages listings and pricing, but none of those capabilities appear in this code chunk. While over-broad descriptions can be acceptable if other chunks implement the missing features, based on this chunk alone the represented functionality is materially broader than the observed behavior. There are no suspicious undeclared capabilities beyond local file output of fetched data.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
### `orders.js` — Orders

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
### `orders.js` — Orders

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
### `orders.js` — Orders

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
### `orders.js` — Orders

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
### `orders.js` — Orders

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
### `orders.js` — Orders

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
### `inventory.js` — FBA Inventory

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
### `inventory.js` — FBA Inventory

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
### `inventory.js` — FBA Inventory

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
### `inventory.js` — FBA Inventory

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill references environment-variable based configuration (AMAZON_SPAPI_PATH) and operational scripts, but does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, missing scope declarations can lead to overbroad access assumptions and make it easier for the skill to read sensitive local configuration without clear user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation includes a listing update command that changes live marketplace pricing, but it does not clearly warn users that these actions affect production seller data. In an agent-driven workflow, insufficient warning increases the risk of unintended business-impacting changes, such as accidental repricing or listing modification.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
## Notes - Tokens auto-refresh via LWA — no manual management - Keep credential files at `chmod 600` - Respect SP-API rate limits per endpoint ## Related

Static analysis

No suspicious patterns detected.