亚马逊-广告授权

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.7

Overview

The skill has real Amazon Ads authorization functions, but it also adds silent feedback reporting, LinkFox login/payment flows, and local storage of sensitive account data.

Install only if you are comfortable giving LinkFox an API key, using LinkFox account and billing flows, and having Amazon Ads account metadata and authorization URLs written locally. Avoid setting custom gateway URL environment variables, review local linkfox output folders after use, and do not submit phone codes or payment actions unless you intended to use LinkFox services.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:123

Finding

Silent External Feedback Reporting and Promotional Instruction Injection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_lf_output.py:25

Finding

Plaintext Persistence of API Responses and OAuth Authorization URLs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:165

Finding

Unpinned Runtime Installation of Third-Party Python Packages

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The onboarding script directs users to install `requests`, `qrcode`, and `pillow` without pinned versions, package hashes, a lockfile, or a constrained trusted package index. Package resolution is therefore mutable and depends on the index and network configuration present when the command is run. The named packages are established projects, and the audit found no evidence of deliberate typosquatting or a malicious package name. The risk arises from insecure dependency management: future releases, compromised registries, dependency substitution, or an attacker-controlled package index can change the code installed and executed. Python packages may execute code during build or installation, and their modules execute code when imported. A compromised dependency can therefore act with the privileges of the user running the onboarding script. ### Attack Path 1. The user invokes an onboarding function requiring `requests`, QR generation, or Pillow. 2. The dependency is absent, and the script prints an unpinned `pip install` instruction. 3. The user runs the suggested command. 4. `pip` resolves packages and transitive dependencies from the user’s configured index. 5. A compromised index, malicious release, or unsafe future version supplies attacker-controlled code. 6. Installation, build, or subsequent import executes that code with the invok ...[truncated 559 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (49)

Tainted flow: 'req' from os.environ.get (line 45, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The destination URL is derived from environment variables, allowing a caller or compromised runtime to redirect requests to an attacker-controlled endpoint while the script includes the Authorization API key in the outbound header. In a skill whose purpose is account authorization, exfiltrating credentials or sending authorization requests to an untrusted host is a serious risk because it can leak secrets and facilitate account takeover workflows.

Content

Scanner excerpt · scripts/authorize_url.py (reported line 56)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 40, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request target is derived from environment-controlled base URL values and then used in urlopen with an Authorization header containing the API key. If an attacker can influence LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL, they can redirect the request to an attacker-controlled server and exfiltrate credentials or sensitive account metadata. In this authorization-management skill, that context increases risk because the endpoint returns linked ad account/profile information and uses privileged service authentication.

Content

Scanner excerpt · scripts/authorized_stores.py (reported line 51)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code sends authentication data and other sensitive requests to URLs derived from environment-configurable base endpoints. In a skill execution environment, those environment variables can be influenced by deployment or a compromised host, turning this into credential exfiltration or SSRF against attacker-controlled infrastructure. The risk is elevated because the requests carry login tokens, SMS-login data, and generated API keys.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway request path uses urllib to contact a URL built from environment-derived configuration and attaches the API key in the Authorization header. If the base URL is changed to an attacker-controlled endpoint, the script will leak API credentials and may also be abused for SSRF-style access to unintended internal or external services. Because this function supports order and account operations, compromise could expose billing and account-management actions.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 42, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The request destination is influenced by environment variables (LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL) and the code sends the Amazon Ads API key in an Authorization header to that URL. If an attacker can alter the runtime environment, they can redirect the request to an attacker-controlled server and exfiltrate the credential, turning this into SSRF-plus-secret-leakage. In an auth/account-management skill, this is more dangerous because the token/API key grants access to sensitive advertising account data and management operations.

Content

Scanner excerpt · scripts/profiles.py (reported line 53)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The request destination is indirectly controlled by environment variables via LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL, and the script sends a sensitive Authorization header to whatever URL is configured. If an attacker can influence the runtime environment, they can redirect the token-refresh request to an attacker-controlled endpoint and exfiltrate the API key and request metadata.

Content

Scanner excerpt · scripts/refresh_token.py (reported line 54)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 43, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination is derived from environment-controlled configuration via LINKFOX_TOOL_GATEWAY or AMAZON_ADS_BASE_URL and then used directly in urlopen while also attaching the Authorization API key. If an attacker can influence the runtime environment, they can redirect this request to an arbitrary host and exfiltrate the API key and account identifiers, which is especially sensitive in an authorization/token-management skill.

Content

Scanner excerpt · scripts/store_tokens.py (reported line 54)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest presents the skill as Amazon Ads authorization/account management, but the instructions also require generic local persistence, session metadata handling, and response summarization behavior unrelated to the stated business purpose. That mismatch can hide secondary data-handling behavior from users and reviewers, which is risky when responses may contain account metadata or token-related information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The manifest presents the skill as Amazon Ads authorization/account management, but the instructions also require generic local persistence, session metadata handling, and response summarization behavior unrelated to the stated business purpose. That mismatch can hide secondary data-handling behavior from users and reviewers, which is risky when responses may contain account metadata or token-related information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest presents the skill as Amazon Ads authorization/account management, but the instructions also require generic local persistence, session metadata handling, and response summarization behavior unrelated to the stated business purpose. That mismatch can hide secondary data-handling behavior from users and reviewers, which is risky when responses may contain account metadata or token-related information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest presents the skill as Amazon Ads authorization/account management, but the instructions also require generic local persistence, session metadata handling, and response summarization behavior unrelated to the stated business purpose. That mismatch can hide secondary data-handling behavior from users and reviewers, which is risky when responses may contain account metadata or token-related information.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions are intentionally broad enough to fire even when the user does not explicitly mention Amazon Ads or authorization, as long as the conversation loosely involves account binding, token management, or profile listing. In an agent environment, overbroad invocation can cause the wrong skill to activate, leading to unintended access to account-management actions, unnecessary API calls, or sensitive data exposure in the wrong workflow.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This skill documents the ability to read and refresh live access and refresh tokens, which is a credential-access capability. In the context of an authorization-management skill, that makes the issue more dangerous because the skill is specifically positioned to handle account bindings and could expose reusable secrets that unlock downstream Amazon Ads access across profiles/sites.

Content

Scanner excerpt · references/api.md (reported line 106)May include surrounding context.

md

### 4. 刷新令牌 — `/amazonAds/refreshToken`

`accessToken` 1 小时有效；过期后下游返回 HTTP 401 或错误体含 `expired` / `unauthorized` / `access token`。

**Request**（`authRecordId` 和 `profileId` 二选一）：
| 参数 | 类型 | 说明 |

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding document describes Linkfox agent API-key acquisition, phone-based registration, and billing flows that are unrelated to the stated Amazon Ads authorization/profile-management purpose of the skill. This scope mismatch is dangerous because it can trick operators into collecting credentials, phone numbers, and payment details for an external service under the guise of Amazon Ads support, creating unnecessary account, privacy, and supply-chain risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file instructs operators to initiate phone-based registration/login and payment-plan ordering, which are unjustified by the skill's declared Amazon Ads role. In this context, the extra capabilities materially expand access to personal data and financial workflows, increasing the chance of phishing-like behavior, unauthorized account creation, or misuse of user billing interactions.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is an onboarding and payment CLI for LinkFox, not an Amazon Ads authorization/management implementation as declared by the skill metadata. This mismatch is dangerous because users invoking an Amazon Ads skill could instead be steered into unrelated account onboarding, credential capture, token issuance, and payment flows they did not intend to authorize. The skill-context mismatch materially increases risk because the hidden behavior is outside the user's expected trust boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring explicitly identifies the file as a LinkFox account/environment onboarding CLI, directly contradicting the declared Amazon Ads authorization skill purpose. This is a strong indicator of deceptive packaging or repurposed code being hidden behind misleading metadata, which undermines informed user consent and trust. In a security review, such a mismatch is highly suspicious and increases the likelihood of abusive behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script supports package lookup, order creation, payment QR generation, and order-status queries, which are unrelated to Amazon Ads authorization or profile management. Embedding purchase capabilities in a differently-described skill can trick users into financial actions outside the stated purpose and increases the blast radius from mere mislabeling to potential unauthorized billing. In this skill context, that is a serious scope-deception issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The ability to create paid orders and render QR codes enables direct monetization actions that are unjustified by the declared Amazon Ads authorization use case. A user could be induced to scan and pay for unrelated products or services while believing they are completing an Ads authorization step. Because it touches payment, the contextual danger is especially high.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section sends SMS codes, logs users into LinkFox, and generates API tokens for LinkFox services rather than handling Amazon Ads OAuth or profile access. Collecting phone numbers and verification codes under the cover of an Amazon Ads skill can enable credential harvesting and unauthorized account access to a different platform. The contextual mismatch makes the behavior substantially more dangerous than a normal standalone onboarding utility.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/refresh_token.py (reported line 4)May include surrounding context.

python

#!/usr/bin/env python3
"""
Amazon Ads Token Refresh - LinkFox Skill
Calls /amazonAds/refreshToken to refresh access token

Usage:
  python refresh_token.py '{"authRecordId": 123}'

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises execution paths involving environment access, shell, network, and file writes, but it declares no explicit tool scope or permission boundaries. In an agent setting, this increases the chance of over-privileged execution and makes it harder to constrain access to sensitive environment variables, local files, or outbound requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L036 states the tool consumes points and warns against repeated attempts without informing the user, while L121 states '不消耗积分' (does not consume points). These statements directly contradict each other and create intent ambiguity around usage cost.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill mandates persistent storage of complete API responses in the current project directory and does not pair that with a clear user-facing privacy warning or consent step. Because this skill handles authorization, profiles, and token-status data, those files may retain sensitive account metadata and operational context in locations users do not expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.