Security audit

亚马逊-Alexa购物助手

Security checks across malware telemetry and agentic risk

Overview

The skill can perform the advertised Amazon Alexa shopping query, but it also includes account onboarding, API-key handling, billing/payment order creation, broad local persistence, and automatic feedback reporting that users should review before installing.

Install only if you are comfortable with LinkFox receiving shopping prompts, Amazon URLs, session metadata, and optional feedback content. Prefer the self-service account setup path, avoid sharing SMS codes unless you intentionally want the agent to onboard the account, confirm every plan/order/payment step, and review or clean the generated linkfox directories if prompts or results may be sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly references environment variables, network access, and writing full responses to disk, yet no permissions are declared or scoped. This weakens reviewability and informed consent, and can let a skill access sensitive runtime data or persist user content without clear authorization boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is a narrow Alexa shopping Q&A skill, but the embedded instructions indicate additional account, login, billing, order, and payment flows via LinkFox services. That mismatch is dangerous because an agent or reviewer may authorize the skill for shopping assistance while it actually drives identity, subscription, and payment-related actions with much higher sensitivity.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation introduces a separate feedback-submission API that is outside the skill's stated Alexa shopping search function. This expands the skill's effective capabilities to exfiltrate user-derived content to another service, creating an unnecessary data flow and increasing the chance an agent sends user content without clear user intent or consent.

Intent-Code Divergence

Low

Confidence: 92% confidence
Finding: The feedback example uses a different skill name than the manifest identifies, which can cause agents or integrators to attribute data to the wrong skill. This kind of identifier mismatch weakens auditability and can lead to accidental cross-skill data submission or confusion during incident review.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script persistently stores full API responses, cache entries, and session metadata to local disk even though the skill is described as a query helper. Those responses may contain user prompts, shopping interests, page context, recommendations, and identifiers, creating unnecessary retention and local data exposure beyond the apparent function of the tool.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The docstring explicitly says writing to /tmp is forbidden and failure should occur when the current directory is not writable, but the implementation silently falls back to the home directory and then the system temporary directory. This discrepancy is dangerous because operators and downstream agents may rely on the documented storage boundary, while the actual code writes potentially sensitive response data to less controlled locations.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file implements SMS login, API-key acquisition, subscription/package discovery, order creation, and payment QR generation, none of which are necessary for an Alexa shopping Q&A skill. Such scope expansion creates a high-risk trust violation: a user invoking a shopping-assistant skill could be prompted into credential onboarding and paid transactions unrelated to the declared function.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code can send SMS verification codes, authenticate users, inspect team membership, and generate or fetch API tokens. In the context of an Amazon shopping-answer skill, these credential and token-management capabilities are unjustified and materially increase the chance of secret exposure, unauthorized account linkage, or abuse of the user's LinkFox account.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill can create orders and render payment QR codes, enabling real-money transactions that are unrelated to Alexa shopping Q&A retrieval. In this context, hidden billing functionality is especially dangerous because it can pressure users into purchases or trigger unintended financial actions under the guise of a recommendation/chat feature.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation text is intentionally broad enough to trigger on many generic shopping requests, even when the user did not request Alexa or Amazon conversational shopping specifically. Overbroad triggering can cause inappropriate tool use, unnecessary external data disclosure, and unintended spend on a paid service.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The API documentation instructs agents to send prompts and optional Amazon page URLs to an external endpoint without any privacy notice or guidance on handling user data. Because prompts may contain personal preferences, purchase intent, or other sensitive context, this omission can cause unintentional third-party disclosure.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The feedback section sends free-form content to a separate external service but does not warn that user statements and experience details will leave the primary tool path. Free-text feedback is especially likely to include sensitive conversational data, so the undocumented secondary transfer increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs collecting a user's phone number and SMS verification code to register/login via a script, but it does not require an explicit privacy notice, consent flow, data-handling limitations, or masking guidance. This creates unnecessary risk of mishandling sensitive authentication data and could enable account takeover or privacy violations if the agent, logs, or operator are compromised.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The executable path sends user-supplied query parameters plus SESSION_ID, MODE_ID, and APP_NAME to a remote gateway without any runtime warning, consent gate, or redaction. In this skill context, prompts may include shopping intent, product URLs, and page context, so silent transmission increases privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The login flow returns the API key in stdout JSON, which is likely to be captured by agent logs, transcripts, calling frameworks, or downstream tools. Exposing long-lived credentials through standard output substantially increases the risk of accidental disclosure and lateral abuse if any surrounding component stores or forwards command results.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill mandates storing complete tool responses in a session-linked directory under the current working directory, which can retain user prompts, URLs, recommendations, and other potentially sensitive content across tasks. Persistent, session-associated storage increases the risk of cross-task data exposure, accidental inclusion in project artifacts, and unauthorized access by other tools or users sharing the workspace.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.