A team of scientists in the US recently completed a year-long experiment to test the Amazon Alexa Skills store for skills compliance with company policies. It turned out that certification of skills is still very poorly organized. An attacker can easily get certified for the skill with serious violations of Amazon’s own policies.

As an experiment, the researchers created 234 children’s Alexa Skills in a deliberate violation of company policy. To their great surprise, 193 skills were certified the first time. The remaining 41 skills were rejected but were certified the second time (32 skills were classified as violating privacy policy and 9 had user interface issues).

Among the Alexa Skills certified provocative skills for kids that Amazon endorsed were skills to craft a firearm silencer (craft skill), craft skill to craft soft drugs (desert data skill), hidden advertising (geography skill), data collection about children’s names (skill with stories) and others. Researchers removed all harmful skills immediately after certification so that users would not accidentally install them.

According to the researchers, which they regularly and repeatedly reported to Amazon, the company’s skills certification service is extremely flawed and works negligently. This is inconsistency in verification (skills with the same violation receive different expert assessments), selective verification of voice commands (lack of depth of skills verification), blind trust in developers (just fill out a form in the application, which no one will check), lack of automation during verification (people make mistakes), banal negligence and the hiring of foreign specialists for certification.

Amazon refutes all of the above findings. According to her representative, children’s skills undergo additional testing after receiving the certificate, and the researchers immediately removed the bad skills from the field of certification and did not allow Amazon specialists to conduct a comprehensive test. In response, the researchers said they were able to find 52 skills in the Alexa Skills store in violation of company policy. A similar test of Google Assistant skills, by the way, showed that Google takes the problem more seriously, although there are also questions about it.

In conclusion, it remains to recommend that parents try to listen to what their children are talking about with voice assistants. Many will surely be surprised and even shocked. But who said that being a parent is easy?