Amazon MCP Server: why it is not safe to use
We found direct cart-deletion behavior without built-in confirmation and local handling of Amazon login cookies and credentials.
What we found
Our review did not find hidden prompt injection, obfuscated code, hardcoded API keys, undisclosed third-party network destinations, remote code download, or privilege-escalation behavior. The main reason this skill did not pass is a destructive shopping action: the `clear-cart` tool removes items from the Amazon cart directly, and its tool description does not require a confirmation step before doing so. In the reviewed implementation, that action loops through the cart and deletes all items.
We also found credential handling that deserves caution. The skill reads Amazon authentication cookies from a local file, and it includes a helper that accepts `AMAZON_EMAIL` and `AMAZON_PASSWORD` from environment variables to log in and save cookies. We did not find hardcoded secrets in the repo, but the example cookie file uses realistic Amazon session-cookie formats and should not be treated as safe to reuse.
What to do instead
Use Amazon skills that require an explicit confirmation step before any destructive account or cart action. Prefer options that avoid direct handling of account cookies or raw login credentials, or isolate those credentials in a dedicated test account and rotate them after use.
Source: https://github.com/rigwild/mcp-server-amazon
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.