Is ChatGPT for Amazon with GPT4 Shulex Copilot safe?
Shulex Copilot is medium risk. Each Amazon visit requests apps.voc.ai/n/extensionConfig, getting JSON that sets review rate limits (10,000 reviews, 100 concurrent), which tiers unlock features, and Shopify/upgrade toggles. No user notice; changes apply within 10 minutes.
Who publishes itShulex VOC - 1 other listing from the same operator, none carrying a finding
Shulex VOC - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 7k+ users between them, none of them carrying a finding.
Shared hosts - 7 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote Config Fetch Allows Server-Side Behavioral Control
Each Amazon visit requests apps.voc.ai/n/extensionConfig, getting JSON that sets review rate limits (10,000 reviews, 100 concurrent), which tiers unlock features, and Shopify/upgrade toggles.
No user notice; changes apply within 10 minutes.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
On an interval
The cached config expires after 600,000 ms. On next Amazon page navigation after expiry, a fresh GET is issued. Changes pushed server-side propagate to all active browser sessions within one cache TTL.
- apps.voc.ai
Remote configuration endpoint, serves JSON payload controlling extension behavior, feature gating, and review-collection rate limits