amazon-research
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
download_videos_from_manifest_with_ytdlp.mjsexecutes theyt-dlptool viapython3subprocesses to download product-related media content. This is a functional requirement for the skill's media processing capabilities. - [EXTERNAL_DOWNLOADS]: The skill performs network operations using author-provided shared libraries to communicate with Amazon and vendor API endpoints (e.g.,
api.postplus.com) for data collection and session management. - [CREDENTIALS_UNSAFE]: The shared configuration library
postplus_cli_config.mjsmanages session tokens and CLI settings by reading and writing to local configuration files in the user's application data directory. - [PROMPT_INJECTION]: The skill processes untrusted external data from Amazon reviews and product descriptions, creating an indirect prompt injection surface. This ingestion is a core part of its intended research function and is managed within the author's data analysis framework.
Audit Metadata