Alexa Still Has a Skills Problem – Hijack Skills Edition

“Alexa, good morning.”

“Good morning, on this day in blah blah blah, someone important did something special.  Insert funny pun.”

Every morning as we unload the dishwasher my daughter and I ask Alexa what the weather is going to be for the day, and follow it up with a “good morning.”  Every morning is the same routine.  Alexa spouts out the fun fact of the day followed by some kind of quip.  It’s corny and basic, but my daughter loves it and sometimes I learn something new.  This happens every day until just last week.

“Alexa, good morning.”

“Good morning, you look great today.”

I thought it was weird, but maybe nothing important had happened on this day, or maybe the servers were screwy and it was just a default response.  We went on with our day.  Until the next day when the same sort of thing happened.  And the next day, and the next.  I didn’t think Amazon did away with the “on this day” messages, since they’d been there from the very beginning, so I got out my app and started looking into the history.  Sure enough there was a new skill installed called “Good Morning” which had taken over my trigger words.

This sort of thing had happened to us before.  A skill named after something very commonly asked of Alexa had been installed when she misheard something someone said.  It’s very simple, when Alexa hears something a little off from what it expects, if there’s a skill with that name, it installs and enables the skill.  Developers are well aware of this, and there’s money to be made in Alexa traffic.  So some developers with less than stellar morals create skills designed to hijack your commands and drive traffic to their skill, which in turn gets them paid by Amazon.

At the time that I’m writing this, there are 4765 skills with “good morning” in the title.  While I’m sure that not every one of those developers is up to something nefarious, there are more skills than I can count simply called “good morning” that do exactly the same thing, almost every one of them has more than a 3.5 star rating, and almost every 5 star rating reeks of bullshit.  I assume that when Alexa decides to enable one of these skills it either takes the highest rated, or there’s some kind of round robin where it grabs one at random.  Clearly a number of these developers are doing exactly what I expected.

This isn’t the first time I’ve complained about Amazon’s complete lack of guardrails on the Skills store.  In the beginning it was the complete lack of search or categories.  Then it was the explosion of trivia skills, which the greater Alexa community likened to Apple’s fart app problem early in the app store’s life.  Now a quick search through the skills store and it’s plain to see Alexa has a skills problem…again.

The root of this problem is that Amazon pays developers based on the popularity and user base of any particular skill.  The payment structure is a bit nebulous, but suffice it to say if you get enough users, and it gets used enough, you’re going to get a decent sized check from Amazon regularly.  In a perfect world, this would push developers to build skills that really push the boundaries, or do highly useful things.  But this isn’t a perfect world.  And a lot of people like me say “good morning” to their Echo every day.  So it’s much easier to slap together a list of platitudes, call it “good morning” and sit back while those sweet tendies (chicken tenders = cash) roll in.

There’s no good solution to this problem, unless you happen to be Amazon, in which case you actually can solve it.  Short of cracking down on nonsense apps and hijackers at the skills store level, all us users can do is police our own installed skills regularly, removing any that have been enabled by mistake (In the app, open More, then Skills & Games, then Your Skills).