1688采购全流程

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:27 AM UTC
• Version: 1.0.4

Overview

The core 1688 procurement workflow is disclosed and guarded, but the skill also includes account onboarding, persistent API-key creation, subscription payment support, and automatic feedback reporting that broaden its scope.

Install only if you trust LinkFox with procurement, account, billing, and feedback data. Use the self-service API-key path when possible, avoid overriding LinkFox endpoint environment variables, treat generated API keys as long-lived secrets, and review payment or feedback actions before allowing the agent to proceed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tainted flow: 'req' from os.environ.get (line 204, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(get_api_base() + path, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=TIMEOUT_SECONDS) as response:
            body = response.read().decode("utf-8")
            return json.loads(body) if body else {}
    except HTTPError as exc:

• Confidence: 95% confidence
• Finding: The request URL and headers are partially derived from environment variables, including LINKFOX_TOOL_GATEWAY and authentication/session metadata, and are sent directly via urlopen. If an attacker can influence the runtime environment, they can redirect requests to an attacker-controlled endpoint and exfiltrate the API key and session identifiers; in a procurement skill, that could enable unauthorized access to order, authorization, logistics, and invoice data or misuse of purchasing actions.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target is derived from environment-controlled base URLs and is used to send sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens. In an agent/runtime environment where env vars can be influenced, this enables server-side exfiltration of credentials to attacker-controlled endpoints with no allowlist or host verification.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request URL is also built from environment-controlled base URLs and sent with the Authorization header containing the LinkFox API key. If the base URL is redirected to an attacker-controlled host, the code will transmit the bearer credential and business requests externally, causing credential theft and misuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no explicit permissions while instructing use of environment variables, network endpoints, and filesystem writes. That mismatch weakens reviewability and can hide the true blast radius of the skill, increasing the chance that sensitive credentials, responses, or order data are handled without adequate policy controls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: A description-behavior mismatch is serious here because the skill is presented as a 1688 procurement workflow but reportedly also performs LinkFox account login, API-key generation, plan purchase, and unrelated payment flows. Hidden authentication and billing functionality expands the trust boundary and could enable credential capture, account takeover, unauthorized charging, or covert monetization outside the user's expected task.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file documents a public feedback-posting API that is outside the stated 1688 procurement scope, creating an unexpected side-effect capability inside a transactional skill. Even though it is not directly code execution, an agent following this documentation could be induced to send arbitrary externally visible content to a separate service, enabling data leakage, unauthorized outbound requests, or abuse of the feedback endpoint unrelated to the user’s procurement task.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key retrieval, subscription plan discovery, and payment flows, which are unrelated to the declared 1688 procurement/fulfillment purpose. Scope divergence is dangerous because it expands the skill's privileges and data handling into account and billing operations users would not reasonably expect from a procurement skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can generate or retrieve persistent LinkFox API tokens for a user account after SMS login. That capability creates a durable credential that can be reused beyond the current session and is not justified by the stated 1688 procurement use case, increasing the blast radius if abused or leaked.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The package listing, order creation, and payment QR rendering implement LinkFox subscription purchasing rather than 1688 procurement order processing. Embedding platform billing functions inside a procurement skill creates an unexpected payment surface and could lead users to authorize charges unrelated to the advertised function.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions direct the operator to collect a user's phone number and use it to send login codes and register/login through a script, but they provide no privacy notice, consent flow, retention limits, or guidance on secure handling of this personal data. In a procurement/onboarding context this can lead to unnecessary collection, mishandling, or disclosure of personal information and account-access credentials.

Static analysis

No suspicious patterns detected.