亚马逊-广告报表

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.7

Overview

The skill can retrieve Amazon Ads reports, but it needs Review because it also handles account credentials, billing flows, and exposes downloaded report data by default.

Install only if you are comfortable with LinkFox handling Amazon Ads report requests and with this skill assisting account setup and billing when auth or balance problems occur. Before use, avoid setting LinkFox API base URL overrides unless you trust the destination, disable serveExtractedFileHttp for sensitive reports, avoid --inline for large or confidential data, and treat saved files, terminal logs, local paths, and temporary localhost URLs as sensitive business data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The script builds outbound request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, access tokens, refresh tokens, and generated API keys, to those endpoints. In an agent environment where skill execution context or deployment variables can be influenced, this creates a realistic SSRF and credential-exfiltration path.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway client uses environment-derived base URLs and attaches the agent API key in the Authorization header before calling urlopen. If the environment variable is modified, the skill can be redirected to an attacker-controlled host that receives the API key and any order/account data, making the flow materially dangerous beyond a generic network call.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill describes capabilities to read environment variables, write files, invoke shell commands, and make network requests, but does not declare permissions or provide a clear least-privilege boundary. That makes review and runtime governance harder and increases the chance of unexpected data access or command execution paths being abused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill's stated purpose is report retrieval, but the documented behavior extends into account login, API key generation, package purchasing/payment, and exposing downloaded files over a local HTTP server. This mismatch is dangerous because operators and users may grant trust for a narrow reporting function while the skill actually performs broader credential, billing, and data-exposure actions.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The document first warns that the tool consumes credits, then later states 'no credits consumed.' Contradictory billing semantics can cause unauthorized spending or mislead users into triggering repeated report-generation requests under false assumptions about cost.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file introduces authentication recovery, phone-based registration, and billing/payment guidance inside a skill whose stated purpose is downloading Amazon Ads reports. This expands the skill’s operational scope into account onboarding and monetization flows, increasing the chance an agent will collect unnecessary sensitive data or trigger unrelated actions when the user only asked for reporting.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Documenting the ability to register users by phone, log them in by SMS code, and initiate plan purchases is unjustified for a report-download skill and creates an unexpected account-creation/payment surface. If followed by an agent, these instructions could cause sensitive account actions, collection of personal data, or financial transactions unrelated to the requested reporting task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script includes functionality to start a local HTTP server and expose downloaded report files, which expands the attack surface beyond simple report retrieval. Because these reports may contain sensitive advertising and business data, unnecessary serving functionality increases the risk of unintended disclosure, especially if binding is changed from localhost or port exposure is misunderstood.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements phone-based login, API-key issuance, subscription discovery, payment ordering, and order-status queries, which are unrelated to the declared Amazon Ads reporting purpose. That scope mismatch is dangerous because it expands the skill into account provisioning and monetization flows that can collect credentials and trigger purchases under the guise of a reporting utility.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The presence of order creation, plan lookup, and QR-code payment functionality introduces billing capabilities that are not justified by the advertised reporting use case. In a skill ecosystem, hidden or unnecessary purchase flows increase the chance of unauthorized charges, social engineering, and sensitive financial-data exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mandates saving complete API responses to disk without warning users that those files may contain sensitive advertising and business performance data. Persistent local storage increases the risk of unintended disclosure through backups, shared workspaces, source directories, or later prompt/context leakage.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents a workflow that exposes downloaded Amazon Ads report data through a temporary local HTTP server by default. Even though it binds to 127.0.0.1, this still increases data exposure risk because any local process, browser extension, malware, or co-tenant on the host with localhost access may retrieve sensitive business report contents during the serving window, and the docs do not prominently warn users or require explicit opt-in.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions tell the agent to request and process a user’s phone number and verification code, but provide no privacy warning, minimization guidance, retention limits, or consent language. That creates a risk of unnecessary collection and mishandling of sensitive personal and authentication data during a workflow that does not inherently require it for report generation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Downloaded report exposure over HTTP is enabled by default without explicit consent, causing sensitive report data to be served automatically. In a reporting skill handling potentially confidential campaign, keyword, and purchase data, this default increases the chance of accidental local disclosure or broader exposure if the host binding is changed.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script prints a preview of the downloaded report content to stderr automatically, which can leak sensitive report rows into terminal history, logs, orchestration transcripts, or agent tool output. In this skill context, ad reporting data may include commercially sensitive campaign and performance details, so even a small preview can be an unnecessary disclosure.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill requires full API responses to be saved and instructs exposing summaries or full content via stdout, while preserving local paths in a predictable workspace directory. In the context of ad reports, this can leak sensitive account identifiers, campaign data, and business metrics to other local users, logs, or downstream tools consuming the terminal output.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to show the complete local file path and temporary access URL for downloaded report data to the user. Combined with the documented local HTTP serving behavior, this creates a clear data-exposure channel that may reveal sensitive reports to unintended local processes, shared terminals, chat transcripts, or anyone with access to the exposed URL.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.