Security audit

亚马逊-ABA数据挖掘

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a LinkFox ABA query skill, but it adds automatic feedback reporting and sensitive onboarding, credential, and billing flows that need review before installation.

Review this skill carefully before installing. Use it only if you are comfortable sending ABA query content, account identifiers, API keys, phone/SMS login data, and billing/order data to LinkFox services. Avoid custom endpoint environment overrides, do not store the API key in global shell startup files, and treat saved query responses and feedback reports as potentially sensitive business data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:159
Finding: Silent transmission of user feedback and inferred intent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/aba_query.py:37
Finding: Environment-controlled endpoints can receive authentication credentials
Content: View full analysis
str: """Gateway base URL: prefer LINKFOX_TOOL_GATEWAY, otherwise use production.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` The resulting destination receives the API key: ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding service destinations are similarly configurable: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` The generic HTTP function sends supplied bodies and headers to those URLs: ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError a ...[truncated 1805 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/onboarding.py:402
Finding: Nonessential token replay and excessive request telemetry
Content: View full analysis
dict: """Trigger credits for a new user. Failure does not block progress.""" resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) if "_error" in resp: return {"error": f"loginByToken: {resp.get('_body') or resp['_error']}"} if resp.get("errcode") != 200: return {"error": f"loginByToken: {resp.get('errmsg') or json.dumps(resp, ensure_ascii=False)}"} print(f"{TAG} loginByToken succeeded; new-user credits were triggered", file=sys.stderr) return {} ``` The caller explicitly treats failure as nonblocking: ```python if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']} (does not prevent key retrieval)", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) ``` ABA requests also transmit identifiers not listed as request requirements in `references/api.md`: ```python headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } ``` ### Technical ...[truncated 1430 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onboarding.py:487
Finding: API key is exposed through standard output and plaintext shell configuration
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} successfully obtained API key (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` The onboarding instructions recommend commands that contain and persist the literal key: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis Printing the API key places it in the Agent transcript and any standard-output capture. Embedding it in a shell command can also preserve it in shell history, process-monitoring records, terminal logs, and automation logs. Appending it to `.zshrc` or `.bashrc` stores it as plaintext and exports it to every descendant process of future shells. The code does not set restrictive file permissions, use an operating-system credential manager, or limit the key to the process that requires it. ### Attack Path 1. The user completes SMS login. 2. The script prints a JSON document containing the full API key. 3. The Agent or user copies the key into one of the documente ...[truncated 620 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/aba_query.py:252
Finding: Unsanitized session identifier permits output path traversal
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script repeats the pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name. Values containing `..` path components can escape the date and LinkFox directories. On platforms where an absolute component overrides preceding components, an absolute `SESSION_ID` can redirect the output entirely. The query path subsequently receives metadata and full API-response files. The onboarding path can receive payment QR images. No canonical-path containment check is performed before directory creation or file writing. ### Attack Path 1. An attacker influences the environment and se ...[truncated 920 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/onboarding.py:163
Finding: Runtime installation guidance uses unpinned third-party dependencies
Content: View full analysis
dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` The HTTP path does the same for `requests`: ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The project does not provide a lockfile, version constraints, package hashes, or an audited dependency manifest. Following the runtime instruction retrieves whichever package versions are currently selected by the configured Python package index. Although the referenced package names are established packages and no typosquatted dependency was identified, mutable, unverified resolution reduces reproducibility and increases exposure to compromised future releases, index substitution, or unsafe build-time behavior. ### Attack Path 1. The dependency is absent from the runtime environment. 2. The script instructs the user or Agent to execute an unpinned `pip install` command. 3. The configured package index or resolver supplies mutable artifacts. 4. A compromised package release, malicious mirror, or substituted index provides attacker-controlled installation content. 5. Package build or installation logic executes with the privileges of the user running `pip`. ### Impact Assessment A compromised dependency can execute code with the installing user's privileges and subsequently access the Skill's API key, login tokens, query results, and local files available to that user. ...[truncated 147 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/aba_query.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 97% confidence
Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, authorization headers, and generated API keys to those endpoints. If an attacker can influence environment variables in the agent/runtime, this becomes credential exfiltration or SSRF to attacker-controlled infrastructure.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 97% confidence
Finding: The gateway URL is derived from environment variables and used by urllib to perform authenticated requests with the API key in the Authorization header. In a compromised or multi-tenant execution environment, an attacker could redirect this traffic to an arbitrary host and capture API credentials, user/package/order metadata, or use the skill as an SSRF primitive.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding indicates the skill or its referenced workflow includes phone login, token retrieval, API key generation, subscription lookup, payment order creation, QR code generation, and payment-status polling—activities outside ABA analytics. Mixing account, authentication, and payment operations into a data-query skill materially expands the attack surface and creates risk of credential and financial misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates the skill or its referenced workflow includes phone login, token retrieval, API key generation, subscription lookup, payment order creation, QR code generation, and payment-status polling—activities outside ABA analytics. Mixing account, authentication, and payment operations into a data-query skill materially expands the attack surface and creates risk of credential and financial misuse.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are overly broad and permit activation even when the user does not explicitly request ABA analysis. Overbroad activation can cause unintended network calls, data processing, or disclosure in unrelated conversations, especially for ambiguous e-commerce requests.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
筛选美国站中"table"的长尾词中，排名在10万-30万之间，且近4周的搜索排名增长50%以上的搜索词。

text
## Display Rules 1. **Present data only**: Show query results in clear tables without subjective business advice 2. **Ranking clarification**: When showing ranking data, remind users that lower values mean better rankings

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements account onboarding, SMS authentication, API key retrieval, package listing, and commerce flows rather than the declared ABA search-term analytics function. This capability mismatch is dangerous because users or hosting platforms may authorize the skill expecting analytics, while the code actually collects identity data and obtains credentials for unrelated account actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Order creation and payment QR rendering introduce a monetization/payment capability that is unrelated to the stated ABA analytics use case. In the skill context, this is especially risky because it can steer users into transactions they did not expect from an analytics tool, increasing phishing, fraud, and unauthorized purchase risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill can send SMS verification codes, authenticate users, and mint or retrieve API keys, none of which is necessary for the advertised ABA analytics workflow. In this context, requesting a phone number and verification code is highly suspicious because it enables account takeover or credential harvesting under the guise of data analysis assistance.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises capabilities that imply environment access, file writes, and network use, but it declares no explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it harder to constrain what the skill may access or modify at runtime.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires writing full API responses to a session-scoped project directory and may print full JSON to stdout, which can persist or expose user-provided data beyond the immediate task. Persistent local storage and verbose output increase the chance of unintended disclosure through logs, shared workspaces, or later tool access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to proactively surface download URLs for full datasets encourages broader dissemination of data than the user may have requested. If links expose large result sets or are shareable, this can expand access to sensitive or commercially valuable data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The boundary guidance still allows activation for vague business phrases if they can be interpreted as search-term analysis. This increases the chance of accidental invocation and unnecessary sharing of user queries with external services.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Automatically sending user feedback or interaction-derived information to a separate Feedback API goes beyond the stated ABA query function. This can exfiltrate user content, preferences, or sentiment to another service without clear necessity or explicit user approval.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 55)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/aba/intelligentQuery \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The feedback API sends freeform content to a separate external endpoint, and the documentation does not warn that user-provided text may be transmitted off-platform. This creates a real data-handling risk because user messages, intents, or sensitive context could be forwarded without explicit minimization or consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The onboarding flow instructs operators to collect a user's phone number and use it in a script-driven registration/login process, but it provides no privacy notice, consent guidance, retention limits, or handling safeguards. In a support/agent skill context, this increases the risk of unnecessary collection and exposure of personal data, especially because phone numbers and verification codes are sensitive authentication-related information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The header documentation promises output will not be written to /tmp and that failure will occur if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This can cause sensitive ABA query results to be persisted in less expected or less protected locations, undermining operator assumptions and increasing the chance of data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The request sends SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME from the environment to an external endpoint. This is a network transmission of potentially sensitive system or user-context metadata, but the code provides no runtime notice or confirmation that these values will be sent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script always writes the full API response to disk, regardless of size, and does so automatically before deciding what to print. Because ABA responses may contain commercially sensitive query analytics, automatic persistence creates unnecessary data-at-rest exposure, especially in shared workspaces or environments with broad filesystem access.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code enforces an 11-digit mainland-China phone format and hard-codes areaCode "+86", while all CLI descriptions and user-facing messages are in Chinese. This imposes a specific locale and language policy without offering user choice or documenting a justified region-specific constraint in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code generates or retrieves an API token and prints it in stdout JSON without any warning, masking, or scoped handling. In agent ecosystems, stdout is often surfaced to users, logs, orchestration layers, or other tools, so this can unintentionally disclose long-lived credentials that enable downstream account access.
Content: No source excerpt is available for this finding.