1688 商品详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.4

Overview

The skill performs a real 1688 product lookup, but it also handles login, API keys, paid order creation, feedback reporting, and persistent local writes in ways users should review before installing.

Install only if you are comfortable letting LinkFox receive product IDs, lookup parameters, API keys, and selected session metadata. Prefer obtaining API keys directly from the provider rather than giving phone numbers or SMS codes to the skill, verify LinkFox endpoint environment variables are not overridden, avoid invoking billing/order commands unless you intend to create a payment order, and clean up local linkfox response/cache files if they contain sourcing or supplier data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:132

Finding

Automatic Feedback Instruction Can Disclose User Intent and Skill Results

Content

View full analysis

This address is independent of the tool gateway above. Do not mix the base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type**: `application/json` { "skillName": "linkfox-1688-product-detail", "sentiment": "POSITIVE", "category": "OTHER", "content": "The product detail matched the requested 1688 offer." } ``` ### Technical Analysis The instruction changes the behavior of the agent beyond the declared product-detail lookup. It directs the agent to infer feedback from ordinary conversations and transmit it to a separate service without requesting permission or interrupting the user. The required feedback content may describe the user's intent, actual lookup results, dissatisfaction, praise, or sourcing requirements. These details can reveal commercial interests and interaction context. The instruction provides no mandatory redaction, data-minimization, consent, or retention controls. This exceeds the minimum privileges needed to retrieve a 1688 product record. Product lookup does not require sending interaction-derived feedback to a second API. ### Attack Path 1. A user invokes the ...[truncated 996 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/alibaba1688_product_detail.py:36

Finding

Sensitive Authentication Requests Can Be Redirected Through Environment-Controlled Origins

Content

View full analysis

str: """Gateway base address: env LINKFOX_TOOL_GATEWAY takes priority.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key not configured. Please complete authorization first:\n" "1. Visit https://skill.linkfox.com/linkfoxskills/guide.htm to obtain your Key\n" "2. Set the environment variable: export LINKFOX_AGENT_API_KEY=your-key-here", file=sys.stderr, ) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` The onboarding script similarly permits replacement of all authentication origins: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATE ...[truncated 2893 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/alibaba1688_product_detail.py:55

Finding

Product Lookup Transmits Unnecessary Platform Context Identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/alibaba1688_product_detail.py:249

Finding

Unvalidated SESSION_ID Allows Writes Outside the Intended Session Directory

Content

View full analysis

str: """Prefer env SESSION_ID; otherwise generate HHMMSS-<6 hex>.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """Return (linkfox_root, session_dir); session_dir always exists.""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script repeats the same issue: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name even though it comes from the process environment. The code does not reject: - Absolute paths. - `..` traversal components. - Forward or backward path separators. - Symlink-based escapes. - Excessively long or otherwise malformed identifiers. In Python, an absolute final component passed to `os.path.join` can discard preceding components. Relative traversal components can also escape the intended `/` ...[truncated 1571 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:161

Finding

Onboarding Recommends Unpinned Runtime Dependency Installation

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} os.makedirs(out_dir, exist_ok=True) png_path = os.path.join(out_dir, f"qr-{int(time.time() * 1_000_000)}.png") qr = qrcode.QRCode(border=1) qr.add_data(content) qr.make(fit=True) qr.make_image(fill_color="black", back_color="white").save(png_path) buf = io.StringIO() qr.print_ascii(out=buf, invert=True) return {"png_path": png_path, "ascii_qr": buf.getvalue()} def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` The original emitted commands are: ```text pip install qrcode pillow pip install requests ``` ### Technical Analysis The suggested commands resolve mutable package versions from the user's currently configured pip index. They do not provide: - Exact reviewed versions. - Package hashes. - A lock file. - A trusted index requirement. - An isolated virtual environment. - Verification of the downloaded artifacts. The script does not automatically execute pip, so exploitation requires the user to follow the emitted recommendation. Nevertheless, the recommendation forms part of the operational onboarding path and encourages an unsafe supply-chain action. ### Attack Path 1. The required Python package is absent. 2. The script emits an instruction to run an unpinned `pip install` command. 3. The user executes the command in the active Python environment. 4. pip resolves packages from the configured index or mirro ...[truncated 784 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (26)

Tainted flow: 'req' from os.environ.get (line 71, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/alibaba1688_product_detail.py (reported line 78)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence environment variables in the runtime, they can redirect authentication traffic to a hostile server and harvest credentials or tokens.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses an environment-derived base URL and attaches the API key in the Authorization header before calling urlopen. A manipulated environment can exfiltrate the agent API key and cause privileged requests such as account, package, or order operations to be sent to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is a simple product-detail lookup, but the detected behavior includes authentication, API key generation/retrieval, account inspection, plan listing, payment order creation, QR rendering, and payment-status checks. This is a major capability expansion that can expose personal data, trigger billing flows, or manipulate account state outside the user's apparent request.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

查询 https://detail.1688.com/offer/1040473674152.html 的标题、属性、SKU、价格库存和供应商信息。

text

## Display Rules

1. Show the product title and offer ID first, followed by the requested product facts.
2. Present SKU results in a table with attributes, stock, 1-piece retail price, wholesale price for quantities of 2 or more, requested-currency prices, and dropshipping price when available.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements SMS login, API key issuance, plan listing, and order/payment workflows that are unrelated to a declared 1688 product-detail lookup skill. That mismatch materially increases risk because the skill can collect credentials and drive account monetization flows under the guise of a product-query capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code can create paid orders and render payment QR codes, which is not justified by the stated product-detail lookup purpose. In a skill context, hidden or unnecessary billing capabilities create a realistic risk of unauthorized charges, social engineering, or misuse of the user's account context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope even though it uses environment variables, persistent file writes, and network access. Without a least-privilege declaration, an agent may grant broader capabilities than users expect, increasing the blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation criteria are broad enough that the skill may trigger on general sourcing or supplier questions whenever a 1688 URL or offerId appears. In context, that increases the chance of unnecessary external calls, persistent logging, and side effects from the broader hidden capabilities identified elsewhere.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires persistent storage of full responses in a session-based directory under the working tree. Even if the intended data is product information, responses may include user-supplied parameters, identifiers, supplier/account metadata, or future expanded fields, and long-lived local storage increases exposure beyond immediate task needs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to automatically report user feedback via an external API without opt-in. User praise, complaints, or improvement suggestions can contain personal, commercial, or conversational data, so silent transmission to a third party creates a privacy and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 243)May include surrounding context.

}

text

## curl 示例

```bash
API_KEY="${LINKFOX_AGENT_API_KEY:-$LINKFOXAGENT_API_KEY}"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file for a 1688 product-detail skill documents an unrelated public feedback endpoint on a different base URL, creating a secondary data-exfiltration path outside the declared tool purpose. In an agent setting, this can cause user inputs, outputs, or other context to be sent to an external service without clear necessity, scope limitation, or separate trust review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The onboarding guide introduces account registration, login, API key provisioning, and paid plan purchase flows that are materially broader than a 1688 product-detail lookup skill's stated purpose. This expands the skill's operational scope into credential handling and commerce workflows, increasing the chance of unnecessary collection of sensitive data and abuse of the agent as an account/payment intermediary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented phone-based registration/login and subscription purchase capabilities are not justified by the product-detail lookup use case, creating unnecessary access to personal data, authentication artifacts, and payment-related actions. In a skill that should only retrieve catalog information, these extra flows materially raise the risk of social engineering, overcollection, and unauthorized account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the operator to solicit a user's phone number and process authentication steps via script without any warning about privacy, consent, secure handling, or avoidance of logging/secrets exposure. Because SMS codes and phone numbers are sensitive authentication data, this omission can lead to credential compromise, accidental retention, or unauthorized account creation/login activity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation explicitly says full responses are written under the current working directory, forbids writing to /tmp, and says the script should error if the current directory is not writable. However, the actual path resolution logic later chooses among ACPX_WORKSPACES, cwd, home directory, and finally the system temp directory, automatically falling back when earlier locations are not writable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends JSON parameters to a remote API and includes SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME in request headers. While the file-level docstring explains output persistence, it does not disclose this network transmission or the sharing of environment-derived metadata, and there is no runtime confirmation prompt.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script persists complete API responses to both a cache path and a session data path, and may also store them outside the current project directory via fallback logic. Because product-detail responses can include supplier, pricing, logistics, and possibly user-linked metadata, silent multi-location persistence increases the risk of unintended disclosure through shared workspaces, backups, temp directories, or later local access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file's docstring and CLI help text are entirely in Chinese, and the phone validation/login flow is hard-coded for 11-digit domestic numbers with area code +86. This imposes a specific language and locale without any opt-in or documented justification in the file.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill performs SMS-based login, obtains access and refresh tokens, derives team information, and retrieves or generates API tokens, all beyond what is necessary for 1688 detail lookup. This broad credential-handling surface increases the chance of accidental exposure, abuse, or deceptive collection of user secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The login flow returns an API key after transmitting a phone number and SMS code to remote services, but this file provides no explicit warning, consent prompt, or security notice about collecting and exchanging those credentials. In the context of a seemingly unrelated sourcing skill, this can mislead users into disclosing secrets they would not reasonably expect to provide.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline comment says responses at or below the threshold are output directly and not written to a file. In main(), the code serializes the result and writes it to out_path unconditionally before deciding whether to print the full JSON or a summary.

Content

No source excerpt is available for this finding.