E Commerce Find Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:58 AM UTC
• Version: 1.0.3

Overview

The skill is a disclosed e-commerce skill finder, but it can install or bulk-update agent skills in a way users should review carefully.

Install only if you intentionally want a LinkFox marketplace helper that can add or update agent skills. Before using install or update commands, review the target skill, publisher, version, and destination workspace, and avoid bulk updates unless you trust all installed skills.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53

Finding

Unverified Third-Party Skill Installation and Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53-86
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

### 第四步：安装

用户确认要安装某个技能后，执行安装命令。CLI 会自动检测当前 agent 平台并安装到正确目录。

```bash
linkfoxskill install slug --workdir workspace

例如：

bash

linkfoxskill install linkfoxlinkfox-aba-data-explorer --workdir ~/.claude

确定你的工作空间目录，然后执行 install 命令：

• 如果你是 Claude Code，工作空间目录是 ~/.claude
• 如果你是 OpenClaw，工作空间目录是你当前的 workspace 路径，如 ~/.openclaw/workspace
• 如果你是其他 Agent，请找到你的 skillworkspace 目录

安装完成后提示用户重启 Agent 以加载新技能。

更新已安装的技能

用户要更新技能时：

bash

linkfoxskill update

或更新指定技能：

bash

linkfoxskill update slug

text

### Technical Analysis

The Skill instructs the Agent to install marketplace-supplied Skills directly into an Agent workspace and then restart the Agent so the installed content is loaded. It also permits both individual and unrestricted bulk updates.

These commands do not pin an immutable version, verify a cryptographic hash or signature, validate publisher identity, inspect downloaded files, or require a permissions review before activation. Consequently, the content executed or interpreted by the Agent may differ over time from the content originally reviewed.

This is a supply-chain weakness rather than evidence that the current package contains a malicious payload. Exploitation requires an attacker-controlled or compromised marketplace package, publisher account, registry backend, distribution channel, or update.

### Attack Path

1. An attacker publishes a malicious Skill or compromises an existing marketplace package, publisher account, or distribution channel.
2. The Agent searches the marketplace and receives the affected package as a result.
3. The user confirms installation, or requests an update to an already installed package.
4. The Agent runs `linkfoxskill install ...` or `linkfoxsk
...[truncated 929 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, immutable package versions for every installation and update.
2. Verify package signatures or trusted cryptographic hashes before writing content into the Agent workspace.
3. Restrict installations to an allowlist of approved registries and verified publishers.
4. Download packages into an isolated staging directory and inspect their instructions, scripts, dependencies, requested permissions, and external communications before activation.
5. Present the package version, publisher identity, integrity information, requested capabilities, and destination path to the user before requesting confirmation.
6. Replace unrestricted linkfoxskill update operations with per-package, version-pinned updates that require explicit approval.
7. Run newly installed Skills in a sandbox with minimal filesystem, network, credential, and tool access.
8. Maintain a lockfile or installation manifest recording package versions and hashes, and support rollback to the previously verified version.
9. Do not instruct users to restart and activate a package until all integrity and security checks have succeeded.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are broad enough to match many ordinary e-commerce conversations, including any discussion of e-commerce topics that 'need tool assistance' and even bulk skill updates. This can cause unintended invocation of a skill that leads users toward searching/installing external skills, increasing the chance of unnecessary tool use, user confusion, or unreviewed third-party skill installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest keyword list includes very generic terms such as '电商', '外贸', and '出海', which overlap with common conversation topics rather than explicit skill-management intent. This makes accidental matching more likely and can steer unrelated conversations into a workflow that searches or installs external skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest states in Chinese that the skill must trigger when users want to search or install e-commerce skills, but it does not indicate multilingual support or user choice of language/locale. This can be a natural-language policy issue because it prescribes one language context without documenting opt-in or a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.