亚马逊-广告授权

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.7

Overview

The skill’s Amazon Ads authorization functions are mostly coherent, but it also includes sensitive LinkFox account, API key, billing, feedback, and broad persistence behaviors that deserve manual review before installation.

Install only if you are comfortable giving this skill access to LinkFox API credentials and Amazon Ads authorization data, and if you accept the related LinkFox onboarding and billing flows. Keep LINKFOX_TOOL_GATEWAY and related base-url environment variables pointed only at trusted LinkFox hosts, avoid using shared machines for OAuth URLs or clipboard handling, and review locally saved linkfox response files for sensitive data retention.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tainted flow: 'req' from os.environ.get (line 45, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The destination base URL is overrideable via environment variables, allowing requests bearing the Authorization API key to be sent to an attacker-controlled endpoint if the runtime environment is influenced. That creates a credential exfiltration path and also sends user-supplied account metadata off-host to an untrusted server.

Tainted flow: 'req' from os.environ.get (line 40, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request destination is derived from environment-controlled base URL configuration and the script sends the Authorization API key to that endpoint. If an attacker can influence LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL, they can redirect the request to an attacker-controlled server and exfiltrate the credential, making this an SSRF-plus-secret-leak issue rather than a harmless configuration pattern.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends authentication material, including access tokens and generated API keys, to those endpoints via requests.post. In an agent/runtime setting, environment variables are part of the trust boundary; if an attacker can influence them, this becomes a server-side credential exfiltration path to arbitrary infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway helper constructs urllib requests to a URL derived from environment variables and attaches the API key in the Authorization header before calling urlopen. If the base URL is redirected to attacker-controlled infrastructure, the skill will disclose the agent API key and potentially perform unintended authenticated actions against a rogue endpoint.

Tainted flow: 'req' from os.environ.get (line 42, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request target is derived from environment-controlled base URL configuration and then used in urlopen while attaching the Authorization API key header. If an attacker can influence LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL, they can redirect the request to an arbitrary host and exfiltrate the bearer-like API credential, creating an SSRF-plus-secret-leak condition. In an auth/account-management skill, this is especially sensitive because the request is meant to access advertising account data and token-related operations.

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request destination is indirectly controllable through environment variables because API_BASE_URL can be overridden by LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL. That means a caller or compromised runtime can redirect this token-refresh request, along with the Authorization API key and token-management payload, to an arbitrary server, enabling credential exfiltration or SSRF-like behavior. In the context of an auth-management skill, this is more dangerous because the code handles sensitive token operations by design.

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 89% confidence
• Finding: The request destination is influenced by environment variables via LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL, and the same request carries the Authorization API key header. In a hostile or misconfigured runtime, an attacker can redirect this call to an arbitrary endpoint and capture the API key and token-related response data, creating an SSRF-style credential exfiltration path.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions while its documented behavior clearly uses environment variables, network/API access, shell-executed Python scripts, and file writes. This creates a hidden-capability problem: operators and downstream agents cannot accurately assess what the skill can access or persist, increasing the risk of over-privileged execution and unnoticed data handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as an Amazon Ads authorization/account-management tool, but the documented behavior also includes unrelated LinkFox account login, API-key acquisition, subscription purchase, payment QR generation, and order-status flows. That scope expansion is dangerous because users and orchestrators may invoke the skill expecting ad-auth operations while it can collect identity data and steer users into billing or account actions outside the declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The instruction to auto-detect and report broad user feedback through a Feedback API is outside the core Amazon Ads auth scope and is triggered by vague conditions such as praise, dissatisfaction, or anything improvable. This can cause silent exfiltration of user sentiments, workflow details, or other conversational content to an external endpoint without clear, task-bound necessity or consent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This onboarding document introduces Linkfox account registration, API key acquisition, and billing workflows that are outside the stated scope of an Amazon Ads authorization/profile-management skill. In a security-sensitive auth skill, unrelated credential and payment flows increase the chance of data over-collection, user confusion, and phishing-like behavior, especially when users may be prompted for phone numbers, verification codes, or platform keys unrelated to Amazon Ads.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs the skill to handle billing, recharge, and payment-order operations for the Linkfox platform, which is unjustified for an Amazon Ads authorization skill. This broadens the trust boundary from ad-account authorization into financial operations, creating unnecessary risk of social engineering, unauthorized charges, and mishandling of payment-related data.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper serializes and persistently writes full API responses and session metadata to local disk under predictable directories, which can include access tokens, refresh tokens, profile identifiers, account bindings, and other sensitive Amazon Ads data. In the context of an authorization and token-management skill, storing complete responses by default expands the data exposure surface well beyond the stated operational purpose and creates risk of credential leakage, unintended retention, and access by other local users or processes.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script persists authorization URLs to local files and copies them to the system clipboard, expanding the skill's access to host state beyond simple auth URL generation. Authorization URLs often contain sensitive OAuth state and client parameters, and persisting them increases exposure to local malware, other users on the system, backups, and clipboard history tools.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Clipboard manipulation is a host-side capability that is not essential to generating an authorization URL and can expose sensitive OAuth links to clipboard managers, remote desktop sync, and other applications monitoring clipboard contents. In a skill context, this is especially risky because it performs an out-of-band action on the user's machine rather than limiting itself to declared API behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file's functionality is materially inconsistent with the declared Amazon Ads authorization skill: it implements LinkFox onboarding, login, API key issuance, package listing, and payments instead of Amazon Ads account binding/profile management. Such scope mismatch is dangerous because it can trick users or the host agent into collecting unrelated credentials and initiating unrelated account operations under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Billing and commerce actions such as plan enumeration, order creation, payment QR rendering, and order-status lookup are unrelated to Amazon Ads authorization and expand the skill into financially sensitive operations. In the context of a misrepresented auth skill, these capabilities increase the risk of deceptive purchases, unauthorized charges, or social engineering users into paying for unrelated services.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script performs SMS-based login to LinkFox, retrieves access/refresh tokens, queries team membership, and generates API keys, none of which are necessary for Amazon Ads authorization. Within this skill context, that is especially dangerous because it enables credential harvesting and token minting for an unrelated platform while presenting itself as an Amazon Ads integration.

Credential Access

High

• Category: Privilege Escalation

Content

### 4. 刷新令牌 — `/amazonAds/refreshToken`

`accessToken` 1 小时有效；过期后下游返回 HTTP 401 或错误体含 `expired` / `unauthorized` / `access token`。

**Request**（`authRecordId` 和 `profileId` 二选一）：
| 参数 | 类型 | 说明 |

• Confidence: 96% confidence
• Finding: This documentation exposes a direct API capability to read and refresh Amazon Ads access and refresh tokens via `/amazonAds/storeTokens` and `/amazonAds/refreshToken`. In an agent-skill context, returning raw bearer tokens to the caller materially increases credential exposure risk: any compromised agent, prompt injection, over-broad authorization check, log sink, or downstream consumer could exfiltrate reusable tokens and gain access to the user's advertising account.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.