Linkfox 1688货源

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:52 PM UTC
• Version: 1.2.3

Overview

This skill largely matches its 1688 sourcing purpose, but it should be reviewed carefully because it combines purchasing/account authority with under-scoped endpoint overrides, public image uploads, and mismatched local data handling.

Install only if you trust LinkFox and are comfortable giving the skill an API key for 1688 sourcing and procurement. Review or pin the gateway environment variables before use, avoid uploading sensitive or proprietary images, expect search results to be saved locally, and treat the printed onboarding API key as a secret that may appear in logs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request sent via `urlopen` includes multiple headers sourced directly from environment variables, and the destination base URL is also overrideable through `LINKFOX_TOOL_GATEWAY`. This creates a real exfiltration path: secrets and session metadata can be transmitted to an attacker-controlled endpoint if the environment is manipulated, which is especially risky in agent/runtime environments where env vars often contain sensitive context.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request is sent to a URL derived from the environment variable LINKFOX_TOOL_GATEWAY, while the Authorization API key is attached to the same outbound request. If an attacker can influence the environment, they can redirect traffic to an arbitrary host and exfiltrate the API key and request data, which is a real SSRF/credential-leak risk rather than a harmless configuration pattern.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The URL used by requests.post is derived from environment-configurable base URLs, and the code sends highly sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. In a skill/agent environment, environment variables may be influenced by the host or a malicious wrapper, so this enables SSRF-style redirection and credential exfiltration to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The urllib Request/urlopen path builds its destination from environment-controlled base URLs and attaches the LINKFOX agent API key in the Authorization header. If an attacker can influence LINKFOX_AGENT_API_URL or related variables, all authenticated gateway traffic can be redirected to an attacker endpoint, leaking secrets and enabling unauthorized actions.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring explicitly states that writing to /tmp is forbidden, but the implementation falls back to tempfile.gettempdir() when other locations are not writable. This contradiction can lead to sensitive API responses being stored in a less controlled temporary location, increasing exposure to other local processes, weak retention controls, or accidental disclosure.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The documented behavior says the script must not write to /tmp and should fail if the current directory is not writable, but the implementation silently falls back to home and temporary directories. In a skill context, that can cause sensitive API responses to be persisted in unexpected locations, including shared or less protected temp storage, increasing the chance of data exposure.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill hard-codes a channel/context requirement ('you are workbuddy' and channel must be 'workbuddy') when handling onboarding, which attempts to override the host agent's execution context without user consent. This can steer the agent into using a different identity or workflow than intended by the platform, creating context-confusion and potentially bypassing normal user choice or policy controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to upload local image files to a publicly accessible URL with a 24-hour lifetime, but it does not provide an explicit privacy or data-handling warning. This can expose sensitive local files, embedded metadata, or proprietary product images to third parties and external indexing during the upload window, especially if users assume the upload is internal or temporary in a safer sense.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that full API responses are always written to project-local JSON files, but it does not warn that potentially sensitive search inputs, returned product data, session-derived paths, and usage metadata will be persisted on disk. This creates avoidable local data retention risk, especially in shared workspaces, synced folders, repositories, or environments where project directories are later committed, backed up, or accessed by other users/tools.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script always writes the full API response to disk, including potentially sensitive business data, regardless of response size. In an agent/tooling context, automatic persistence under the working directory can leak data into repositories, shared workspaces, backups, or logs without the user's informed consent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script forwards SESSION_ID, MODE_ID, and APP_NAME from the environment in HTTP headers without an explicit runtime disclosure or minimization. In agent environments, these identifiers may reveal internal workflow, tenant, or session metadata to the remote service and can become sensitive when combined with other logs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script caches and stores full API responses on disk under predictable local paths without any minimization, retention control, permission hardening, or user warning. If the API returns product, account, token, or other sensitive business data, local persistence increases exposure to other local users, backup systems, or later unintended disclosure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The login command emits the obtained API key directly to stdout JSON. In agent and CLI environments, stdout is commonly captured by orchestrators, logs, transcripts, shell history wrappers, or downstream tools, so this can expose a long-lived credential beyond the intended user.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script uploads a user-specified local image to remote object storage and explicitly sets `x-oss-object-acl: public-read`, making the object publicly accessible. It returns the public URL but does not present a clear runtime warning or confirmation that the file will be exposed publicly, which can lead to accidental data disclosure if users upload sensitive images.

Static analysis

No suspicious patterns detected.