Linkfox 1688货源

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 1.2.3

Overview

This looks like a real LinkFox 1688 sourcing and procurement skill, but it has credential and privacy handling weaknesses that users should review before installing.

Install only if you trust LinkFox and are comfortable giving the skill account-scoped API access for 1688 sourcing and procurement. Before use, avoid setting custom LINKFOX_* API endpoint variables, treat generated API keys and shell-profile exports as sensitive, confirm every order/payment/cancel/receipt action carefully, and do not upload local images unless they are safe to make accessible by URL.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_alibaba1688_common.py:60

Finding

Environment-controlled API endpoints can receive authentication credentials and sensitive business data

Content

View full analysis

str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Authentication tokens are then attached to requests sent to those destinations: ```python def _headers ...[truncated 3206 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:478

Finding

Onboarding prints the complete generated API key to standard output

Content

View full analysis

dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: 手机号格式不正确: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: 验证码格式不正确: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}（不影响拿 key）", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token( lg["access_token"], lg["user_id"], info["group_id"], ) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The returned object is emitted without redaction: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` ### Technical Analysis A successful onboarding operation r ...[truncated 1723 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_image.py:86

Finding

Local images are uploaded with a public-read object ACL

Content

View full analysis

str: """Extract the base public URL by stripping query parameters.""" return presigned_url.split("?")[0] ``` The upload and public URL are then exposed to the caller: ```python # Step 1: Get presigned URL presigned_url = get_presigned_url(content_type, extension) # Step 2: Upload file upload_file(presigned_url, file_path, content_type) # Step 3: Output public URL public_url = extract_public_url(presigned_url) print(json.dumps({"url": public_url}, indent=2, ensure_ascii=False)) ``` ### Technical Analysis Uploading a local image is part of the declared image-search capability. However, the script explicitly requests the `public-read` ACL and converts the presigned upload URL into a query-free public URL ...[truncated 1776 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:160

Finding

Installation guidance uses unpinned packages and an unverified remote Skill archive

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` The procurement reference supplies an additional mutable archive installation path: ```text - Prefer the onboarding.md guidance included in the Skill. - If onboarding.md cannot be found, load the /linkfox-onboarding Skill. If it is not installed, install it first: - Download https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip, extract it, and install this Skill. ``` ### Technical Analysis The fallback guidance instructs users to install `qrcode`, `pillow`, and `requests` without pinning versions or verifying hashes. It also recommends downloading and extracting a mutable `release.zip` without specifying a cryptographic checksum, digital signature, expected file manifest, or safe extraction process. The current repository does not automatically run `pip`, download the archive, or execute a remote payload. Therefore, this is not direct remote code execution in the audited code. The risk arises only when a user or agent follows the installation instructions. Package indexes and the referenced archive are exp ...[truncated 1374 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (37)

Tainted flow: 'req' from os.environ.get (line 128, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request destination and several outbound headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY, SESSION_ID, MODE_ID, and APP_NAME. If an attacker can control the process environment, they can redirect requests to an attacker-controlled host and exfiltrate the API key in the Authorization header, making this an SSRF/credential-leakage issue rather than a harmless configuration pattern.

Content

Scanner excerpt · scripts/_alibaba1688_common.py (reported line 130)May include surrounding context.

python

}
    req = Request(get_api_base() + path, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=TIMEOUT_SECONDS) as response:
            body = response.read().decode("utf-8")
            return json.loads(body) if body else {}
    except HTTPError as exc:

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The request destination and headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY and metadata headers such as SESSION_ID, MODE_ID, and APP_NAME. If an attacker can control the environment, the script can be redirected to an arbitrary endpoint and will transmit the API key and session metadata there, causing credential and context exfiltration.

Content

Scanner excerpt · scripts/dld_product_billboard.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/alibaba1688_image_search.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/dld_product_search.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data to them via requests.post. In this skill, those requests can include phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, so a malicious or misconfigured environment can redirect secrets to an attacker-controlled server.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is derived from environment variables and used in urlopen with an Authorization header carrying the API key. If an attacker can influence the environment, they can redirect authenticated requests to an external endpoint and capture the API key and account-related data.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 69)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 102)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

---
name: linkfox-1688-sourcing
display_name: Linkfox 1688货源
display_name_en: LinkFox 1688 Sourcing
description: 1688 货源一站式 AI 工具集，整合商品搜索、热销榜单、以图搜图与已授权采购履约，覆盖找货、选品、比价、图搜同款与下单全流程。
description_zh: 1688 货源一站式工具集：店雷达商品搜索与热销榜单（关键词/链接/ID 检索、周榜月榜、多维筛选排序、批发价/代发价/销量与供应商资质）、1688 以图搜图（图片 URL/Base64/imageId 视觉检索同款货源，含本地图片上传）、1688 已授权采购全流程（OAuth 授权检查、SKU/收货地址、下单预览、创建订单、支�

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

4. **采购展示**：依赖 OAuth 时先展示授权状态，不单凭浏览器跳转判断；下单预览清晰展示商品/SKU/数量/单价/运费/收货地址/订单总额/异常提示；`authorizedStores` 输出是当前用户授权状态，不要描述成数据库全库账号列表。
5. **高风险确认**：创建订单、获取支付链接、取消订单、确认收货前复述精确操作、关键 ID、金额/状态（如可得），请用户中文自然语言确认；不要求用户输入内部 boolean 字段（`=true` 由 Agent 注入）。
6. **不可用数据**：值为 `0` 或 `-1` 的字段表示数据不可用，标注"N/A"或省略，不作实际值展示。
7. **敏感信息**：永不展示完整 API key、JWT、access token、refresh token、callback code、app secret、session key、Authorization header；收货地址展示到足以安全选择即可，避免不必要重复完整手机号或敏感细节。
8. **错误处理与协同**：查询失败时根据响应 `errcode`/`errmsg` 说明原因并建议修正（关键词需中文、日期格式、ASIN/offerId 格式、授权不足等）；连续使用多工具时（如先图搜找 offerId 再采购下单）将各工具发现汇总为连贯分析，标注数据来源与时间窗；返回 `costToken` 等成本字段时如实展示。

## 解决认证和积分问题

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/linkfox-1688-procurement.md (reported line 120)May include surrounding context.

md

1. 采购依赖 OAuth 时先展示授权状态；不单凭浏览器跳转判断授权。
2. `authorizedStores` 输出是当前 LinkFox 用户的 1688 授权状态，不要描述成数据库全库账号列表。
3. 永不展示完整 API key、JWT、access token、refresh token、callback code、app secret、session key、Authorization header。
4. 清晰展示下单预览：商品/offerId、SKU/规格、数量、单价、商品总价、运费、收货地址、订单总额、买家留言、警告。
5. 高风险调用前复述精确操作、关键 ID、金额/状态（如可得），请用户中文确认；不要求用户输入内部 boolean 字段。
6. 收货地址展示到足以安全选择即可，避免不必要地重复完整手机号或敏感地址细节。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/linkfox-1688-procurement.md (reported line 282)May include surrounding context.

md

1. 采购依赖 OAuth 时先展示授权状态；不单凭浏览器跳转判断授权。
2. `authorizedStores` 输出是当前 LinkFox 用户的 1688 授权状态，不要描述成数据库全库账号列表。
3. 永不展示完整 API key、JWT、access token、refresh token、callback code、app secret、session key、Authorization header。
4. 清晰展示下单预览：商品/offerId、SKU/规格、数量、单价、商品总价、运费、收货地址、订单总额、买家留言、警告。
5. 高风险调用前复述精确操作、关键 ID、金额/状态（如可得），请用户中文确认；不要求用户输入内部 boolean 字段。
6. 收货地址展示到足以安全选择即可，避免不必要地重复完整手机号或敏感地址细节。

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

��后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先�

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill hard-codes channel/language behavior ('you are workbuddy' and channel must be workbuddy) in its operational instructions, which can override the hosting agent's normal trust boundaries and user-driven context. This is dangerous because skill-authored routing rules can cause the agent to invoke onboarding or account flows under an unintended channel, potentially misdirecting authentication, telemetry, or user data without explicit user opt-in.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill mandates always writing the full API response to project-local session files, even when only a subset of fields is needed for the immediate task. This increases data retention and secondary exposure risk because user-supplied image references, search metadata, and returned product records may remain on disk longer than necessary and become accessible to other tools, users, or later sessions in the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly tells the agent to upload a user-provided local image to obtain a publicly accessible URL, but it does not require an explicit consent or privacy warning before doing so. That can expose sensitive local files or user content to anyone with the URL for up to 24 hours, which is a real confidentiality risk in the context of handling arbitrary user images.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/linkfox-1688-search-by-image.md (reported line 285)May include surrounding context.

}

text

## curl 示例

### 基础以图搜图

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrases are broad enough to match ordinary shopping, sourcing, or trend-discovery requests, which can cause the skill to activate outside its intended niche. That increases the chance of unintended external API calls and disclosure of user-provided product interests or sourcing intent to a third-party service without sufficiently clear routing boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/linkfox-dld-product-billboard.md (reported line 236)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/dld/productBillboard \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file states that keyWord must be in Chinese and that non-Chinese keywords must be translated before querying. This imposes a language requirement on users without presenting it as an opt-in choice or clearly scoping it as a justified region-specific policy exception.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction says that when a user provides an English product term, the skill should first translate it into Chinese and then call the tool. This is a natural-language policy issue because it enforces a specific language workflow without asking the user whether they want translation or prefer to provide their own Chinese term.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/linkfox-dld-product-search.md (reported line 222)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/dld/productSearch \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to collect a user's phone number and process SMS-based registration/login, but it provides no privacy notice, consent language, data minimization guidance, or handling restrictions for this personal data. In an agent workflow, this increases the risk of unnecessary collection, retention, exposure in logs, or transmission without the user's informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring explicitly promises not to write to /tmp and to fail if the current directory is not writable, but the implementation silently falls back to ~/linkfox and then $TMPDIR/linkfox. In an agent setting, this can cause sensitive API responses to be persisted in unexpected, less controlled locations, increasing the risk of data leakage, cross-session exposure, or accidental retention contrary to operator expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring promises that writing to /tmp is forbidden and that a non-writable current directory should cause an error, but the implementation silently falls back to the home directory or temporary directory. This can cause sensitive API responses to be written to less trusted or unexpected locations, weakening data handling guarantees and making accidental disclosure more likely.

Content

No source excerpt is available for this finding.