Skills/Glama/asin402

asin402@1.0.0

VERIFIED

Publisher claims: "This server provides live Amazon product data, including current prices, price history, FBA profit calculations, and selling opportunity scores. It enables AI assistants to analyze Amazon listings and purchasing opportunities across multiple marketplaces via paid per-call USDC transactions." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher httpx402 · publishing for 1 daysInstalls 0Last detonated 19 h ago
$npx skills add asin402
WatchReport an issue

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
ASIN402_PRIVATE_KEYConfiguration, not credentials: ASIN402_BUDGET, ASIN402_MAX_PER_CALL, ASIN402_MAX_RESPONSE_CHARS, ASIN402_NETWORK, ASIN402_URL
Where it talks to
asin402.com (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for ASIN402_PRIVATE_KEY and talks to asin402.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets ASIN402_PRIVATE_KEY=asin402.com -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 93/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 44 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
24sprocessdependency install exit 0
44sclaimed14 tools: check_deal, sell_score, fba_profit, product_snapshot, get_products, search_products, find_products, find_deals, best_sellers, seller_info, category_info, search_categories, top_sellers, wallet_status
44stoolsc13b8e669f7ff14c
44stools7e16cee588a87f0b
44stools37265bf552ca8543
44stools74bb059b0cde9aba
44stoolsec9d7dd994607d07
44stoolsc383f14fb0c6aabd
44stoolsf2d7e864a99b00ef
44stools7501723db6cd3e68
44stoolsbfcfef128e6dd383
44stools3b98463a13ec0a0c
44stoolsf40f95bd7509620c
44stools9fee78e9da5ace95
44stools77c52ee84832f9d2
44stoolsec2349d29c10e535
44sprocessscript backend runs setup only
44sprocessno install scripts to re-run

Static findings

No findings across 2,028 lines in 10 files.

Cost to the agent

Instructions loaded
≈34 tok
1 file · 10 in bundle
Tool list per prompt
≈2,518 tok
14 tools · 180 per tool
Handshake
2006 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 189

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.