AIGC文本生成

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.2.2

Overview

This text-generation skill also includes account login, API-key issuance, and payment/order workflows that deserve review before installation.

Review this carefully before installing. It is not just a text-generation helper: it can guide users through LinkFox SMS login, produce or retrieve an API key, list paid plans, create payment orders, and display payment QR codes. Only use it in an environment where LinkFox endpoint environment variables are trusted, avoid submitting sensitive media URLs or prompts unless acceptable for remote processing, and treat any API key printed by the script as a secret.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 88% confidence
• Finding: The script reads `LINKFOX_TOOL_GATEWAY` from the environment and sends the API key in the `Authorization` header to that URL via `_post`. If an attacker can influence the runtime environment, they can redirect requests to an arbitrary server and capture the credential, turning environment-controlled configuration into credential exfiltration.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, and the request may include SMS login data, access tokens, refresh tokens, or authorization headers. In an agent/runtime environment where env vars can be influenced by deployment or a malicious wrapper, this enables redirection of sensitive authentication traffic to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway request URL is built from environment-derived base URLs and is used with the API key in the Authorization header. If an attacker can influence those environment variables, they can exfiltrate the API key and manipulate order/account operations by forcing requests to an attacker-controlled endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation indicates capabilities to read environment variables, write files, and make network calls, yet it declares no permissions. This creates a transparency and least-privilege problem: reviewers and users cannot accurately assess what the skill can access, and hidden capability scope can enable unauthorized data exfiltration or local file persistence if the implementation is compromised or misused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is text generation, but the documented behavior includes authentication, account lookup, package purchase, order creation, payment QR generation, and payment-status polling. This is a major scope expansion into account and billing operations, which can cause unauthorized purchases, collection of sensitive account data, or social-engineering style misuse because users would not reasonably expect a writing tool to initiate payment flows.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The onboarding document introduces authentication recovery, phone-based registration, and billing workflows inside a text-generation skill, materially expanding the skill's operational scope beyond its stated purpose. This increases attack surface and user risk because the skill may prompt for credentials, phone numbers, or payment actions in contexts where users expect only content generation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill directs collection of a user's phone number, execution of login/registration commands, and purchase/order flows that are not necessary for a text-generation feature. In this context, those capabilities are unusually dangerous because they can facilitate account creation, identity linkage, and financial transactions under the guise of a benign writing tool.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS login, API-key acquisition, package listing, ordering, and payment QR generation, which is materially unrelated to the advertised AI text-generation capability. Such scope divergence is dangerous because it introduces credential handling and financial workflows that users and reviewers would not expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can create orders and generate payment QR codes, adding direct purchasing capability to a skill presented as text generation. In context, this mismatch materially raises fraud and abuse risk because the skill can drive financial actions outside its stated purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file performs SMS-based authentication, token exchange, team discovery, and API-key generation, all beyond the declared text-generation scope. This is dangerous because it collects credentials and provisions long-lived access material under a misleading feature description.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are broad and match common requests such as '帮我写一段', 'AI写作', '图片识别', and '视频分析'. Over-broad triggers increase the chance of accidental invocation, causing user prompts or media URLs to be sent to the remote service without sufficiently intentional selection, especially problematic given the skill's additional billing/account behaviors noted in the analysis.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill supports image and video URL analysis but does not clearly warn that supplied media URLs and associated prompts will be transmitted to a remote AI service. This is a privacy and data-handling issue because users may unknowingly expose sensitive media, internal URLs, or tokenized links to third parties.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The API documentation explicitly states that user prompts, media URLs, and optional member IDs are sent to a remote service, but it does not provide any privacy notice, data-handling disclosure, or warning for users before transmission. In a multimodal text-generation skill, these fields may contain sensitive personal, business, or image/video-derived data, so lack of disclosure can lead to unintended data sharing and privacy/compliance risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document tells the operator to ask for a user's phone number and use a script to send codes and log in, but provides no privacy notice, retention limits, consent language, or guidance on secure handling of that personal data. This creates a real privacy and security issue because users may be induced to share sensitive identifiers and one-time codes without understanding how they will be processed.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI emits a newly obtained API key directly to stdout as JSON, which can be captured by terminal history, calling processes, logs, or transcript systems in agent environments. Exposing credentials through standard output significantly increases the chance of accidental leakage and downstream compromise.

Static analysis

No suspicious patterns detected.