amz-customer-question-mining

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime “Mine” step pulls the listing’s Customer Questions (including unanswered questions authored by shoppers/outsiders) and then the “Answer”/“Cluster” steps ingest those question texts into the agent’s LLM context for drafting responses, which is indirect prompt-injection exposure from outsider-authored free text.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for high-entropy literal values that can grant access. The document contains no API keys, PEM/private key blocks, environment variable values, or obvious passwords. The only string resembling a high-entropy token is the WhatsApp invite URL "https://chat.whatsapp.com/ILX65p1yWcaIG3c9WGHpTY". That URL contains a random-looking join code which can be used to access the WhatsApp group, so it functions as an access token rather than a mere documentation placeholder. All other values are generic placeholders (e.g., "ASIN") or normal text and are ignored.