Skills amazon-competitor-analyzer
📦
amazon-competitor-analyzer
Content revision r2 Medium Risk 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands
Analyze Amazon Competitors by ASIN
Manual Amazon competitor research is slow and inconsistent. This skill retrieves product data through BrowserAct, compares core metrics, and creates local reports.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "amazon-competitor-analyzer" from https://skillstore.io/skills/browser-act-amazon-competitor-analyzer.md and its manifest at https://skillstore.io/api/skills/browser-act-amazon-competitor-analyzer/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "amazon-competitor-analyzer". Analyze one valid ASIN and save results to the current directory.
Expected outcome:
The skill validates the ASIN, retrieves its BrowserAct result, and creates CSV, Markdown, and JSON report files.
Using "amazon-competitor-analyzer". Compare four competing ASINs for pricing and ratings.
Expected outcome:
- Price positioning identifies the observed lowest and highest prices.
- Rating analysis identifies the highest rating and orders products by review volume.
- Failed or unavailable product records remain visible in the generated reports.
Using "amazon-competitor-analyzer". Analyze an invalid ASIN.
Expected outcome:
The skill reports the invalid identifier and skips submission for that item.
Security Audit
Medium Riskv6 • 7/23/2026 Open versioned report
Most high-severity detections are false positives from placeholders, expected credential handling, Markdown fences, and documented environment setup. The executable makes disclosed BrowserAct requests and writes reports to user-selected directories. CLI secrets and unescaped spreadsheet fields remain meaningful risks.
3
Files scanned
502
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (3)
Medium
API Key Exposed Through Command Arguments
The --api-key option places a credential in command arguments, which may persist in shell history and appear in process listings.
The argparse option directly accepts the API key as a command-line value, a well-established local credential exposure path.
Medium
Spreadsheet Formula Injection in CSV Reports
Externally sourced product fields are written to CSV without neutralizing formula prefixes, which can trigger formulas when a report opens.
Product title, brand, and feature values flow from the API response into csv.writer without checks for equals, plus, minus, or at signs.
Medium
Incomplete Secret Storage Guidance
Setup directs users to store a real key in .env without warning them to exclude that file from version control.
Both files explicitly direct creation of a credential-bearing .env file, while the reviewed setup text provides no source-control warning.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Python file write/append
with open(output_path, 'w', newline='', encoding='utf-8') as f:
CSV output uses write mode and can truncate an existing file at the selected destination. No collision check or overwrite confirmation exists.
Medium
Python file write/append
with open(output_path, 'w', encoding='utf-8') as f:
Markdown output uses write mode and can truncate an existing file at the selected destination. No collision check or overwrite confirmation exists.
Medium
Python file write/append
with open(output_path, 'w', encoding='utf-8') as f:
JSON output uses write mode and can truncate an existing file at the selected destination. No collision check or overwrite confirmation exists.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The library function creates a caller-selected directory and then writes three predictable files there. This is disclosed but modifies the filesystem.
Medium
Python os file operations
os.makedirs(args.output, exist_ok=True)
The CLI creates the user-selected output directory before writing reports. Existing report files can be replaced without confirmation.
Low
Python HTTP libraries
response = requests.post(
The POST sends an ASIN and bearer credential to the fixed BrowserAct API. This disclosed integration still creates third-party network exposure.
Low
Python HTTP libraries
response = requests.get(
The GET polls BrowserAct with the bearer credential and task identifier. It is intended but confirms external network access.
Low
Python HTTP libraries
response = requests.get(
The GET retrieves task results from BrowserAct using the bearer credential. It is intended but confirms external network access.
Low
Hardcoded URL
API_BASE_URL = "https://api.browseract.com/v2/workflow"
This constant fixes all workflow traffic to api.browseract.com. The known HTTPS endpoint limits scope, but network access is real.
Low
Python environment access
os.environ.setdefault(key, value.strip())
The fallback parser imports every key-value entry from the local .env file into the process environment. This broad mutation exceeds the single required key.
Low
dotenv library
load_dotenv(env_file)
load_dotenv reads all entries from the script-local .env file into the process environment. This is expected configuration access but is broader than one key.
Low
Python dotenv loader
load_dotenv(env_file)
The loader reads the entire script-local .env file into the process environment. The behavior is disclosed but accesses more than the required variable.
Risk Factors
🌐 Network access (8)
🔑 Env variables (22)
.env.example:5 amazon_competitor_analyzer.py:39 amazon_competitor_analyzer.py:43 amazon_competitor_analyzer.py:43 amazon_competitor_analyzer.py:21 amazon_competitor_analyzer.py:23 amazon_competitor_analyzer.py:28 amazon_competitor_analyzer.py:30 amazon_competitor_analyzer.py:23 amazon_competitor_analyzer.py:28 amazon_competitor_analyzer.py:43 amazon_competitor_analyzer.py:51 amazon_competitor_analyzer.py:53 amazon_competitor_analyzer.py:56 amazon_competitor_analyzer.py:350 amazon_competitor_analyzer.py:351 SKILL.md:107 SKILL.md:4 SKILL.md:53 SKILL.md:59 SKILL.md:114 SKILL.md:118
📁 Filesystem access (5)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/browser-act-amazon-competitor-analyzer/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/browser-act-amazon-competitor-analyzer?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/browser-act-amazon-competitor-analyzer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/browser-act-amazon-competitor-analyzer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/browser-act-amazon-competitor-analyzer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
browser-act. (2026). amazon-competitor-analyzer security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/browser-act-amazon-competitor-analyzer/audits/6BibTeX citation
@techreport{browser-act-browser-act-amazon-competitor-analyzer-2026,
author = {browser-act},
title = {amazon-competitor-analyzer security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/browser-act-amazon-competitor-analyzer/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "amazon-competitor-analyzer security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "browser-act"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/browser-act-amazon-competitor-analyzer/audits/6"
identifiers:
- type: other
value: "skillstore:browser-act-amazon-competitor-analyzer:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Compare a Product Shortlist
Collect prices, ratings, and review counts for candidate products before prioritizing deeper research.
Benchmark Market Pricing
Compare the lowest and highest observed prices across selected ASINs and export the source data.
Track Competing Listings
Create repeatable local reports for a known set of competing Amazon listings.
Try These Prompts
Analyze One ASIN
Analyze ASIN [ASIN]. Validate it, retrieve available product data, and save all reports to [OUTPUT_DIRECTORY].
Compare Several Products
Compare these ASINs: [ASIN_LIST]. Summarize price, rating, and review volume differences, then save the reports to [OUTPUT_DIRECTORY].
Benchmark Pricing and Reviews
Analyze [ASIN_LIST]. Identify the lowest price, highest price, top rating, and largest review volume using only retrieved data.
Audit a Competitive Dataset
Analyze [ASIN_LIST] and save reports to [OUTPUT_DIRECTORY]. Flag failed records, missing fields, and metric outliers without inventing unavailable insights.
Best Practices
- Use only ASINs that you are authorized to research and follow applicable marketplace terms.
- Store the BrowserAct key in a protected environment variable and review report destinations before running.
- Verify missing fields and failed tasks before using the comparison for business decisions.
Avoid
- Do not pass production API keys through shared shell commands or recorded automation logs.
- Do not treat the output as sentiment, visual, or moat analysis because those features are not implemented.
- Do not overwrite an existing report directory without reviewing its current files.
Frequently Asked Questions
What credentials are required?
A BrowserAct API key is required. The skill reads BROWSERACT_API_KEY or accepts a key through its Python interface.
Does the skill access Amazon directly?
No. It submits ASINs to a fixed BrowserAct workflow and retrieves the resulting task data.
Which report formats are generated?
The implementation generates CSV, Markdown, and JSON reports together.
What comparisons are implemented?
It compares observed prices, average ratings, and review counts. Other advertised strategy analysis is not implemented.
How are invalid ASINs handled?
Each ASIN must contain exactly ten alphanumeric characters. Invalid values are reported and skipped.
Can reports replace existing files?
Yes. The current implementation writes predictable filenames and can replace existing reports in the selected directory.
Developer Details
Author
browser-actLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/browser-act/skills/tree/main/solutions/ecommerce/amazon-competitor-analyzerRef
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
4 downloads · 83 views
File structure