amazon-sp-listing-optimizer

SUSPICIOUS. The skill's stated purpose and Amazon-facing capabilities are mostly coherent, and the confirmation gating is a strong benign signal. The main risk is trust and visibility: core actions rely on custom MCP servers and unseen local scripts, and the optional image workflow forwards user credentials to third-party services and storage. I found no confirmed malware or explicit credential-harvesting behavior in the provided text, but the unverifiable execution components keep this above benign.

The code is a legitimate image-validation utility with no clear malicious behavior. Its main security risks are potential SSRF through unrestricted HTTP(S) URLs, arbitrary local-file reads within the process permissions, and memory exhaustion because download and file-size limits are enforced after complete reads. Restrict URL destinations, stream responses with a hard byte cap, and enforce local-file/resource limits when handling untrusted input.