Skills amazon-buy-box-monitor-api-skill
📦
amazon-buy-box-monitor-api-skill
Content revision r2 High Risk 🌐 Network access🔑 Env variables⚙️ External commands
Monitor Amazon Buy Box Listings by ASIN
Amazon sellers need current Buy Box, price, fulfillment, and competitor information for specific listings. This skill submits ASINs to BrowserAct and returns structured marketplace results.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "amazon-buy-box-monitor-api-skill" from https://skillstore.io/skills/browser-act-amazon-buy-box-monitor-api-skill.md and its manifest at https://skillstore.io/api/skills/browser-act-amazon-buy-box-monitor-api-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "amazon-buy-box-monitor-api-skill". Check ASIN B005O2ZU68 on the Amazon US marketplace.
Expected outcome:
- Illustrative result: Example Seller holds the Buy Box at USD 24.99.
- Availability: In stock. Fulfillment: FBA.
- Another offer is USD 26.49 with a USD 2.00 shipping fee.
Using "amazon-buy-box-monitor-api-skill". Compare the Buy Box with other sellers for ASIN B005O2ZU68.
Expected outcome:
- Illustrative result: The Buy Box offer has the lowest displayed total price.
- Example Seller has a 98 percent rating and 2,450 feedback entries.
- Confirm current values before making pricing decisions.
Security Audit
High Riskv6 • 7/23/2026 Open versioned report
The skill performs disclosed HTTPS requests to BrowserAct and reads BROWSERACT_API_KEY from the environment. Most alerts are documentation or identifier false positives, but the skill solicits credentials and returns untrusted remote output. Marketplace URLs also lack local domain validation.
2
Files scanned
200
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Untrusted remote output reaches the agent
Remote BrowserAct output is returned or serialized verbatim. Malicious marketplace text could become indirect prompt injection when an agent consumes the result.
The direct remote-output path is explicit in the script. Exploitability depends on whether the consuming agent treats returned text as instructions.
Medium
Marketplace URL lacks domain validation
The command-line marketplace URL is sent unchanged to a remote browser workflow. The skill does not restrict it to HTTPS Amazon marketplace domains.
The script accepts argv[2] and forwards it without parsing or allowlisting. BrowserAct may enforce controls remotely, but none exist in this skill.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True)
The CLI tells the user to provide an API key "to me." This can cause credential disclosure in chat or agent context.
High
Generic API/secret keys
Before running, you must check the `BROWSERACT_API_KEY` environment variable. If it is not set, do n
The instructions require the agent to prompt and wait for the user to provide the API key. This encourages disclosure into agent or chat context.
Medium
Ruby/shell backtick execution
```bash
The fenced example instructs the agent to execute the bundled Python script with substituted user values. Raw quote characters could alter a shell-built command.
Low
Python HTTP libraries
res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers, timeout=3
This performs a real outbound POST to BrowserAct with the supplied ASIN and marketplace. It also sends the API key in the Authorization header.
Low
Python HTTP libraries
status_res = requests.get(f"{API_BASE_URL}/get-task-status?task_id={task_id}", headers=headers, time
This performs authenticated polling against the fixed BrowserAct API. The request is expected, but it is genuine third-party network activity.
Low
Python HTTP libraries
task_info = requests.get(f"{API_BASE_URL}/get-task?task_id={task_id}", headers=headers, timeout=30).
This sends an authenticated request to BrowserAct to retrieve task results. The fixed HTTPS destination limits, but does not remove, third-party data exposure.
Low
Python getenv function
api_key = os.getenv("BROWSERACT_API_KEY")
The script reads BROWSERACT_API_KEY from the process environment. Access is limited to the credential explicitly required by the skill.
Low
getenv function call
api_key = os.getenv("BROWSERACT_API_KEY")
This is genuine environment access for BROWSERACT_API_KEY. It does not enumerate or read unrelated environment variables.
Risk Factors
🌐 Network access (10)
scripts/amazon_buy_box_monitor_api.py:33 scripts/amazon_buy_box_monitor_api.py:54 scripts/amazon_buy_box_monitor_api.py:79 scripts/amazon_buy_box_monitor_api.py:15 scripts/amazon_buy_box_monitor_api.py:17 scripts/amazon_buy_box_monitor_api.py:102 scripts/amazon_buy_box_monitor_api.py:108 SKILL.md:22 SKILL.md:36 SKILL.md:37
🔑 Env variables (10)
scripts/amazon_buy_box_monitor_api.py:93 scripts/amazon_buy_box_monitor_api.py:93 scripts/amazon_buy_box_monitor_api.py:17 scripts/amazon_buy_box_monitor_api.py:21 scripts/amazon_buy_box_monitor_api.py:93 scripts/amazon_buy_box_monitor_api.py:99 scripts/amazon_buy_box_monitor_api.py:104 scripts/amazon_buy_box_monitor_api.py:110 SKILL.md:4 SKILL.md:20
⚙️ External commands (20)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/browser-act-amazon-buy-box-monitor-api-skill/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/browser-act-amazon-buy-box-monitor-api-skill?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/browser-act-amazon-buy-box-monitor-api-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/browser-act-amazon-buy-box-monitor-api-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/browser-act-amazon-buy-box-monitor-api-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
browser-act. (2026). amazon-buy-box-monitor-api-skill security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/browser-act-amazon-buy-box-monitor-api-skill/audits/6BibTeX citation
@techreport{browser-act-browser-act-amazon-buy-box-monitor-api-skill-2026,
author = {browser-act},
title = {amazon-buy-box-monitor-api-skill security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/browser-act-amazon-buy-box-monitor-api-skill/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "amazon-buy-box-monitor-api-skill security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "browser-act"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/browser-act-amazon-buy-box-monitor-api-skill/audits/6"
identifiers:
- type: other
value: "skillstore:browser-act-amazon-buy-box-monitor-api-skill:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Check Buy Box ownership
Identify the current Buy Box owner, price, fulfillment method, and availability for a product listing.
Compare competing offers
Review seller prices, shipping fees, ratings, and feedback counts for one ASIN.
Audit listing position
Assess whether a managed seller holds the Buy Box and compare its offer with alternatives.
Try These Prompts
Check one listing
Check the Buy Box for ASIN {ASIN} on {MARKETPLACE}. Report owner, price, currency, fulfillment, and availability.Compare seller offers
Compare the Buy Box with other offers for ASIN {ASIN} on {MARKETPLACE}. Include price, shipping, ratings, and feedback counts.Analyze competitive position
Analyze ASIN {ASIN} on {MARKETPLACE}. Rank offers by total price and note fulfillment, availability, rating, and feedback differences.Evaluate a target seller
Check ASIN {ASIN} on {MARKETPLACE}. Assess {SELLER_NAME} against competitors using Buy Box ownership, total price, fulfillment, rating, and feedback count.Best Practices
- Store BROWSERACT_API_KEY in the environment and never provide it through chat or prompts.
- Use only trusted HTTPS Amazon marketplace URLs.
- Treat results as time-sensitive third-party data and verify important decisions independently.
Avoid
- Do not paste API keys into conversations, prompts, or command arguments.
- Do not submit non-Amazon URLs as marketplace inputs.
- Do not treat a single result as historical monitoring or guaranteed current data.
Frequently Asked Questions
Does this skill require an API key?
Yes. It requires BROWSERACT_API_KEY from a BrowserAct account.
Which Amazon marketplaces are supported?
The script accepts a marketplace URL. Use a valid HTTPS Amazon marketplace and confirm BrowserAct supports that region.
How long can one check take?
The script polls every ten seconds and stops after five minutes if the task does not finish.
Can it monitor many ASINs automatically?
It processes one ASIN per invocation. Batch scheduling and historical tracking require external orchestration and storage.
What information can it return?
It can return product, Buy Box, price, currency, fulfillment, availability, competing offer, rating, and feedback information.
Does the script store retrieved data?
The script does not write local files. It sends task inputs to BrowserAct, so review the provider's data practices.
Developer Details
Author
browser-actLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/browser-act/skills/tree/main/solutions/ecommerce/amazon-buy-box-monitor-api-skillRef
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
3 downloads · 61 views
File structure