AIGC多场景视频生成

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.2.2

Overview

This video-generation skill is not clearly malicious, but it needs Review because its support flow also handles phone/SMS login, API-key generation, account lookup, and payment ordering.

Install only if you are comfortable sending image URLs, prompts, and generated outputs to LinkFox services and storing generated media/responses locally. Prefer getting an API key directly from the official LinkFox site instead of sharing a phone number or SMS code through the skill, verify any LINKFOX_* endpoint variables point to expected LinkFox HTTPS hosts, and review any plan/order/payment QR flow before paying.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, so a hostile runtime can redirect login and token-related requests to an attacker-controlled server. Because these requests can carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this enables credential exfiltration and account compromise. The danger is heightened because this onboarding script handles authentication and key issuance, which is unrelated and over-privileged for a video-generation skill.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and then used in urlopen with the Authorization header containing the agent API key. If an attacker can influence environment variables, they can redirect these requests and capture the API key or manipulate billing/order operations. In this skill context, that risk is more severe because the script also performs account, package, and payment actions outside the claimed media-generation purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation indicates use of environment variables, network access, and local file writes, but no explicit permissions are declared. This creates a transparency and trust problem: users and hosting platforms cannot accurately assess the skill’s operational scope, including outbound data transfer and local persistence. In this context, the skill sends user images/prompts to remote services and writes outputs to disk, so undeclared capabilities are security-relevant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The static finding indicates the skill includes materially different behavior from its stated purpose, including SMS-based login, API-key acquisition, account/user-info queries, order creation, payment QR generation, and payment-status polling. Those actions expand the trust boundary from video generation into credential handling and payment workflows, exposing users to account takeover, privacy, and unauthorized purchase risks if invoked unexpectedly or opaquely.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes a separate feedback submission API that is unrelated to the core video-generation function and could be invoked to transmit user-derived content to an additional external service. Even though it is documented rather than auto-executed here, including a secondary exfiltration-capable endpoint in a skill increases the chance that agents or integrators send user data, logs, or conversation summaries without clear user consent or necessity.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is an onboarding and commerce CLI that sends SMS codes, logs users in, issues API keys, lists plans, creates orders, and renders payment QR codes, none of which are necessary for a multi-image video generation feature. This is dangerous because it expands the skill’s privilege and data-collection scope to sensitive identity, authentication, and billing workflows, increasing the blast radius for abuse or compromise.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This section implements package lookup, order creation, and payment QR generation, enabling direct monetization flows inside a skill that is described only as a video-generation tool. Embedding purchase operations in an unrelated skill increases the chance of unauthorized charges, phishing-like behavior, and misuse of stored credentials or tokens. The mismatch between declared function and billing capability makes the behavior more suspicious and risky.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This code performs SMS-based login, token exchange, user/team discovery, and API key retrieval/generation, which exceeds the stated purpose of generating videos from images. Collecting verification codes and minting API keys inside the skill creates a high-value credential-handling path that can be abused for account takeover or long-lived unauthorized API access. In context, this is especially dangerous because users invoking a video tool would not reasonably expect full account onboarding and key issuance.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill states that generated videos are automatically downloaded to the session media directory and raw API responses are written to a data directory, but it does not present this as an explicit storage warning. Silent local persistence can expose sensitive generated content, metadata, or signed URLs to unintended access, especially in shared or multi-tenant environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes calling remote API endpoints to create and poll video-generation tasks but does not clearly warn that user-supplied images and prompts are transmitted off-platform for third-party processing. Because inputs may contain personal, proprietary, or sensitive visual/text content, lack of disclosure undermines informed consent and increases privacy/compliance risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The API requires sending image URLs and optional prompt text to a remote gateway, but the documentation provides no user-facing disclosure that user assets and text leave the local system. This creates a privacy and compliance risk because users may unknowingly submit sensitive images or prompts to a third-party service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The response states generated videos are stored on OSS and returned via hosted URLs, but users are not warned that outputs will reside on external object storage. This matters because generated media may contain sensitive or proprietary content and externally hosted artifacts can be retained, shared, or accessed beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document instructs operators to collect and submit a user's phone number to a script for registration, but it does not include any privacy notice, consent guidance, retention limits, or handling requirements for this personal data. In a support/onboarding flow, this creates a real privacy and compliance risk because sensitive user data may be collected or processed without adequate disclosure or safeguards.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 89% confidence
• Finding: The code transmits sensitive user and authentication data to external services via requests.post. External transmission is expected for networked tools, but here it is security-relevant because the transmitted data includes phone numbers, SMS codes, tokens, and potentially API keys used for account access. Combined with configurable endpoints, this creates meaningful exfiltration risk.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 91% confidence
• Finding: The alternate environment variable name is part of the same credential-harvesting behavior, increasing the chance that any available API key is consumed by this script. Because the file also handles account and payment workflows, possession of that key can enable broader unauthorized actions than users would expect from a video-generation skill.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 91% confidence
• Finding: The alternate environment variable name is part of the same credential-harvesting behavior, increasing the chance that any available API key is consumed by this script. Because the file also handles account and payment workflows, possession of that key can enable broader unauthorized actions than users would expect from a video-generation skill.

Static analysis

No suspicious patterns detected.