Security audit

亚马逊-广告管理

Security checks for vulnerabilities and agentic risk

Overview

The skill does implement Amazon Ads management, but it also adds automatic external feedback reporting, account and payment flows, credential handling, and local persistence behaviors that need careful review before installation.

Install only if you are comfortable giving this skill authority to query and change Amazon Ads data through LinkFox and to write full responses locally. Before use, keep LINKFOX_TOOL_GATEWAY and related endpoint overrides unset unless you trust the destination, avoid exposing API keys or SMS codes in transcripts or logs, review any billing/payment prompt separately, and keep the linkfox output directory out of source control with a plan to delete retained responses.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:311
Finding: Silent External Feedback Objective Hijacks Agent Behavior
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/_common.py:40
Finding: Configurable Gateway Can Redirect API Keys and Advertising Payloads
Content: View full analysis
str: """ 获取配置在环境变量的API Key。如果获取不到，按 SKILL.md 的 **## 解决认证和积分问题** 处理。 """ key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key 未配置", file=sys.stderr, ) sys.exit(1) return key def call_gateway(endpoint: str, payload: dict) -> dict: api_key = get_api_key() data = json.dumps(payload).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=150) as resp: return json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis The gateway origin is fully controlled by `LINKFOX_TOOL_GATEWAY` or `AMAZON_ADS_BASE_URL`. The code does not validate the URL scheme, hostname, port, certificate identity beyond default client behavior, or whether the destination is an approved LinkFox service. Every gateway request attaches the complete LinkFox API key in the `Authorization` header. Developer-proxy payloads can also contain profile IDs, regions, Amazon API paths, filters, campaign data, bids, budgets, targeting configuration, and create/update bodies. Consequently, control over the process environment is sufficient t ...[truncated 1301 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:478
Finding: Generated API Keys Are Exposed Through Standard Output and Shell Configuration Guidance
Content: View full analysis
int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboarding guide then recommends commands that embed the key directly: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The login command returns the newly obtained API key as part of a JSON object and prints that complete object to stdout. In an Agent environment, stdout may be captured in conversation transcripts, command logs, CI logs, terminal scrollback, or telemetry. The recommended setup commands embed the secret directly in command-line text and persist it in plaintext shell profile files. This can expose the key through shell history, process auditing, backups, dotfile synchronization, terminal logs, or permissive filesystem permissions. The implementation provides no secure storage mechanism, output redaction, permission hardening, expiration warning, or credential-rotation workflow. ### Attack Path 1. The user completes SMS verification and inv ...[truncated 944 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_common.py:711
Finding: Unsanitized Session Identifier Permits Path Traversal and Out-of-Scope File Writes
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): """落盘完整响应到 linkfox///data/-.json；大响应只打印摘要。无缓存。""" serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` Equivalent onboarding construction: ```python sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) ``` ### Technical Analysis `SESSION_ID` is accepted verbatim and inserted into a filesystem path. The code does not reject: - Absolute paths. - `..` traversal components. - Platform-specific directory separators. - Excessively long values. - Symlink-based escapes. The final path is not resolved and checke ...[truncated 1352 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_common.py:677
Finding: Full Sensitive Responses Can Be Persisted to Undocumented Fallback Locations
Content: View full analysis
str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` ```python out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) print(f"Saved full response: {out} ({len(serialized)} bytes)") except OSError as e: print(f"Failed to save to {out}: {e}", file=sys.stderr) _lf_update_meta(session_dir, skill=slug, file_rel=os.path.relpath(out, session_dir), ts=ts) ``` The implementation contradicts the documented guarantee at `SKILL.md:132`, which states that writing to `/tmp` is prohibited and that an unwritable current directory must result in an error. ### Technical Analysis The output layer always serializes and persists complete API responses. If the preferred workspace is unavailabl ...[truncated 1682 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/onboarding.py:163
Finding: Onboarding Recommends Installing Unpinned Runtime Dependencies
Content: View full analysis
dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis When dependencies are absent, the Skill instructs the user or Agent to install `qrcode`, `pillow`, and `requests` without version constraints, hashes, a lockfile, or a trusted package-index requirement. A bare `pip install` resolves mutable package versions using the runtime's configured package indexes. This exposes the environment to package-index substitution, compromised future releases, malicious mirrors, dependency confusion in customized environments, and unexpected breaking changes. The affected packages are imported into a process that handles login tokens, API keys, phone numbers, team identifiers, payment URLs, and QR content, which increases the consequences of a compromised dependency. ### Attack Path 1. The onboarding script runs in an environment where one or more dependencies are absent. 2. The script emits a bare `pip install` instruction. 3. A user or automated Agent follows the instruction. 4. `pip` resolves packages from the environment's configured index without an audited lockfile or hashes. 5. A compromised package release, malicious mirror, or substituted package is installed. 6. Package installation hooks or imported module code executes with the privileges of the current user. 7. The malicious dependency can access onboarding secrets and any files or environment v ...[truncated 469 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (43)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 97% confidence
Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material to those endpoints via requests.post. Because this script handles SMS login, access tokens, refresh tokens, and API key generation, a tampered environment can redirect those secrets to an attacker-controlled server, causing credential exfiltration and account compromise.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The gateway URL is also derived from environment variables and used in urllib.request.urlopen with the Authorization header populated from LINKFOX agent API keys. An attacker who can influence the runtime environment can redirect privileged API traffic to an arbitrary host and harvest credentials or manipulate onboarding and order operations.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior does not cleanly match the described purpose: the skill includes local persistence of responses/session data and dependency plumbing that are not clearly disclosed as part of Amazon Ads management. This mismatch is dangerous because reviewers and users may authorize a business tool while overlooking data retention and auxiliary behaviors that expand privacy and security risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior does not cleanly match the described purpose: the skill includes local persistence of responses/session data and dependency plumbing that are not clearly disclosed as part of Amazon Ads management. This mismatch is dangerous because reviewers and users may authorize a business tool while overlooking data retention and auxiliary behaviors that expand privacy and security risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior does not cleanly match the described purpose: the skill includes local persistence of responses/session data and dependency plumbing that are not clearly disclosed as part of Amazon Ads management. This mismatch is dangerous because reviewers and users may authorize a business tool while overlooking data retention and auxiliary behaviors that expand privacy and security risk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
python scripts/sp/list_campaigns.py '{"profileId":1234567890,"region":"NA",

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
python scripts/sp/list_ad_groups.py '{"profileId":1234567890,"region":"NA",

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
python scripts/sp/list_product_ads.py '{"profileId":1234567890,"region":"NA",

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`） - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/_common.py (reported line 7)May include surrounding context.
python
All list_*.py scripts import from this module for: - Dependency check (linkfox-amazon-ads-auth must be installed) - LINKFOXAGENT_API_KEY retrieval - /amazonAds/storeTokens call to get access token - /amazonAds/developerProxy call with the right method / Content-Type per ad product - Auto-pagination across Sponsored Products / Sponsored Brands (nextToken) and Sponsored Display (startIndex + count offset)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements SMS login, API key issuance, package purchasing, and order querying for the platform itself rather than Amazon Ads management described by the skill metadata. That mismatch increases supply-chain risk because users invoking an ads-management skill may unknowingly expose phone numbers, verification codes, and account credentials to unrelated account/bootstrap flows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Payment order creation, package purchase, and QR-code payment rendering are unrelated to managing Amazon SP/SB/SD campaigns and materially expand the capability surface into billing workflows. In this context, such code can enable unexpected charges, phishing-like payment prompts, and user confusion under the guise of an Amazon Ads tool.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill exposes capabilities consistent with environment access, shell execution, network access, and file writes, but the manifest does not declare any tool scope or allowed-tools boundaries. In an agent setting, missing least-privilege constraints increases the blast radius of prompt injection or misuse because the runtime may permit broader actions than users or reviewers expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill metadata description is entirely specified in Chinese and presents the skill as operating in that language, while the document provides no explicit option for users to choose another language or locale for interaction. Under the policy, locale or language constraints should be opt-in or clearly justified; here there is no user-facing language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs that complete API responses be always written to disk in the working directory, but it does not clearly warn users that account-linked advertising data and session-organized outputs will be persistently stored locally. This creates a privacy and data-governance risk because sensitive business data may remain on disk, be committed to source control, or be read by other tools/users on the same machine.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Persistently storing full user/account-linked API responses in the project working directory by default materially increases the risk of sensitive data exposure. In this context, Amazon Ads metadata can include account structure, campaign names, identifiers, budgets, and operational details; saving all of it by default makes leakage through local compromise, backups, logs, or accidental repository inclusion much more likely.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document contains contradictory billing guidance: one section says the tool consumes credits and warns against extra retrieval attempts, while another states '不消耗积分' (does not consume credits). Inconsistency around cost semantics can mislead users or agents into making unintended paid calls, which is especially risky for automated retry or exploration flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents all operational instructions and reference material exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 79)May include surrounding context.
与上面的工具 API base URL 不同：

bash
curl -X POST https://skill-api.linkfox.com/api/v1/public/feedback \ -H "Content-Type: application/json" \ -d '{"skillName":"linkfox-amazon-ads-manager","sentiment":"POSITIVE", "category":"OTHER","content":"实体查询结果与预期一致"}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: 该文件的自然语言内容全部为中文，且没有说明可根据用户偏好切换语言，也没有提供英文或多语言选项。根据语言/locale 政策，若技能内容强制特定语言而未取得用户选择或明确限定场景，属于自然语言策略风险。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The onboarding instructions direct the operator to collect and use a user's phone number and SMS verification code for account registration/login, but they do not require explicit user consent, disclose how the data will be handled, or warn about privacy implications. In a skill that brokers third-party account access and credential setup, this creates a real privacy and account-security risk because sensitive identifiers and one-time codes could be mishandled or requested without adequate notice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill's stated purpose is Amazon Ads query and mutation through a dependent auth skill, but this module uses subprocess.run to execute another Python script for dependency checking. Spawning a subprocess is a stronger execution capability than the manifest suggests and is not an obvious requirement of ad-management logic itself.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/_common.py (reported line 68)May include surrounding context.
python
sys.exit(DEPENDENCY_EXIT_CODE) try: result = subprocess.run( [sys.executable, str(checker)], capture_output=True, text=True,

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The shared helper persistently writes full API responses, session metadata, and indexing information to local storage outside the core Amazon Ads management function. Because ad-management responses can contain account identifiers, campaign data, and possibly operational metadata, this creates an unnecessary data-retention surface and increases the chance of local disclosure to other users, processes, or later tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: API responses are written to disk automatically without explicit user warning or confirmation. In this skill context, those responses may include sensitive advertising account data, identifiers, and operational outputs, so silent persistence can violate least surprise and materially increase data exposure risk on shared or unmanaged systems.
Content: No source excerpt is available for this finding.