Back to skill

Security audit

1688-以图搜图

Security checks across malware telemetry and agentic risk

Overview

This image-search skill mostly does what it says, but it also includes account, credential, payment, public upload, persistence, and automatic feedback behaviors that need review before installation.

Install only if you are comfortable with LinkFox receiving image URLs or uploaded local images, search parameters, API keys, phone/SMS onboarding data, account and billing requests, and automatic feedback content. Avoid using it with confidential images unless you accept that local files may be uploaded to a public URL, and review or disable feedback, persistence, and onboarding/payment flows where possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
96% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares only an image-search purpose, yet its instructions require environment variable access, file writes, and network operations without any explicit permission declaration or user-facing scoping. This increases the chance of overbroad execution and makes it harder to audit what data may be accessed, transmitted, or persisted during use.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The static finding indicates the skill behavior extends far beyond image search into account login, SMS verification, API key lifecycle, billing plan retrieval, payment order creation, QR code generation, and order-status checks. Those are sensitive identity and financial actions that are not disclosed by the manifest, so a user invoking a benign sourcing skill could unknowingly trigger account, credential, or payment workflows.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill requires automatic reporting to a separate Feedback API even though its stated function is 1688 image search. Undisclosed secondary data flows are risky because user prompts, sentiment, and interaction details may be exfiltrated to another service without a clear need-to-know basis or informed consent.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Automatically reporting praise, dissatisfaction, or anything 'that could be improved' is broader than necessary for performing image search and invites collection of subjective user content unrelated to the requested task. This creates unnecessary privacy exposure and a channel for transmitting conversation-derived data to a third party.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The documentation introduces a separate feedback-posting capability that is outside the stated image-search purpose of the skill. This expands the skill's effective scope to include outbound transmission of user-derived content to another external endpoint, creating an unnecessary data egress path that could be misused for exfiltration or undisclosed telemetry.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
A feedback API is not justified by the core function of searching 1688 by image, so its presence creates hidden capability creep. In an agent setting, such extra endpoints can be invoked with conversation content or inferred user data, enabling unintended disclosure to a third party without being necessary to complete the requested task.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The docstring promises all output stays under the current working directory and explicitly forbids `/tmp`, but `_linkfox_root()` falls back to `~/linkfox` and the system temp directory. This can cause sensitive API responses to be written to locations with weaker access controls or outside the user's expected project boundary, undermining operator trust and data-handling assumptions.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file implements phone-based account onboarding, token acquisition, API key provisioning, plan discovery, and purchase flows, which are unrelated to the declared 1688 image-search function of the skill. Capability mismatch is dangerous because it expands the skill's authority into account management and monetization, increasing the blast radius if the skill is invoked or abused.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code can create orders, render payment QR codes, and query payment status, enabling billing actions not justified by an image-search skill. In context, this is especially risky because a user invoking a product-search feature would not reasonably expect payment workflows or order creation capabilities to be present.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The login flow obtains access tokens, inspects team information, and retrieves or generates API tokens for a group, which exceeds the manifest purpose of image-based supplier search. This broader account-management capability can be abused to mint reusable credentials and pivot into other LinkFox resources.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The helper adds a local-file upload and public hosting step that is broader than the stated 1688 image-search purpose. Scope expansion matters because users may believe the skill only performs search, while it actually transfers local data to a third-party storage service first.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code explicitly uploads files with public-read access and returns a public URL, creating external exposure of local images. For a search-oriented skill, making user-provided or local files publicly accessible materially increases privacy and confidentiality risk, especially if images contain sensitive product, personal, or proprietary information.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The local image upload flow instructs the agent to upload a user-provided local file to obtain a public URL valid for 24 hours, but it does not prominently warn that the file will become publicly accessible. If users provide proprietary product photos, internal documents, or personal images by mistake, the skill could expose sensitive content to anyone with the URL.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The feedback API section tells the agent to send free-form content to an external service but does not warn that this content leaves the local skill context. Without an explicit disclosure, operators or downstream agents may include user statements, intent, or problem descriptions that contain sensitive information, causing avoidable privacy leakage.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The onboarding instructions explicitly direct collecting a user's phone number and sending it to a local script for registration, but provide no privacy notice, consent language, retention limits, or handling safeguards. This creates a real privacy and compliance risk because the agent may solicit and process personal data without informing the user how it will be used or protected.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script transmits user-provided search parameters plus `SESSION_ID`, `MODE_ID`, and `APP_NAME` to a remote service, but the usage/help text does not clearly warn users about this outbound data sharing. In a skill that may process image URLs and sourcing queries, this can expose potentially sensitive workflow metadata or proprietary product research without informed consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script caches and persists full API responses locally, including large-result outputs and cache files, without prominently warning users that returned data may remain on disk. Because this skill aggregates sourcing results and metadata into session directories and caches, it increases the risk of unintended local disclosure, retention, or later collection by other processes/users on the host.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script uploads local file contents to remote infrastructure and returns a public URL, but the usage text does not clearly warn about disclosure, third-party transmission, or public accessibility. In this skill context, that omission is significant because users may supply local images assuming a search-only operation rather than external publication.

Ssd 3

Medium
Confidence
93% confidence
Finding
The skill instructs persistent logging of full tool responses into session-scoped files under the current project directory. Persisting full responses can retain user-provided URLs, search parameters, supplier data, and possibly account/billing-related error messages beyond the immediate task, creating avoidable data exposure to other users, tools, or future runs in the same workspace.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
88% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.