亚马逊-Alexa购物助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.7

Overview

This shopping skill is mostly coherent, but it also includes account login, API-key provisioning, payment-order creation, persistent response storage, and automatic feedback reporting that deserve review before installation.

Install only if you are comfortable with LinkFox receiving shopping prompts and with the skill helping manage LinkFox account setup and billing. Avoid using environment endpoint overrides unless you fully trust them, do not share SMS codes unless you intend to create/login to a LinkFox account, rotate any API key that appears in logs or transcripts, and review local linkfox output folders for retained prompts, responses, QR images, and credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:71

Finding

Environment-controlled API endpoints can exfiltrate credentials and authentication tokens

Content

View full analysis

str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` These values are subsequently used for requests carrying phone numbers, SMS verification codes, access tokens, refresh tokens, API keys, user IDs, and team identifiers: ```python r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) ``` ```python resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) ``` ```python resp = _http_post( f"{_login_base()}/linkFoxApp/api/userCenter/userInfo", {}, _headers( "agent-linkfox-web", "agent.linkfox.com", access_token=access_token, user_id=user_id, ), ) ``` The same pattern exists in `scripts/amazon_alexa_search.py:37-80`, where `LINKFOX_TOOL_GATEWAY` controls the destination receiving the API key, session metadat ...[truncated 2089 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/amazon_alexa_search.py:251

Finding

Unsanitized SESSION_ID permits path traversal and writes outside the intended session directory

Content

View full analysis

str: """优先 env SESSION_ID；缺省按 HHMMSS-<6 hex> 生成（同一进程内稳定）。""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` A corresponding unsanitized construction exists in `scripts/onboarding.py:153-158`: ```python sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) ``` ### Technical Analysis `SESSION_ID` is used directly as a filesystem path component. It is not restricted to a safe identifier grammar and is not checked after path normalization. Values containing `..` can escape the date directory. On systems where an absolute final component causes `os.path.join` to discard preceding components, an absolute `SESSION_ID` can replace the intended root entirely. The scripts then create directories and files under the resulting location, including `_meta.json`, response JSON, and QR images. Writes occur with the process user's filesystem privileges. ### Attack Path 1. An attacker controls or i ...[truncated 996 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/amazon_alexa_search.py:104

Finding

Full user prompts and API responses are persistently stored in plaintext, including a temporary-directory fallback

Content

View full analysis

CACHE_TTL_SEC: return None try: with open(path, encoding="utf-8") as f: payload = json.load(f) if isinstance(payload, dict): payload.setdefault("_cache", {})["hit"] = True return payload except (OSError, json.JSONDecodeError): return None def _save_cache(path, payload): try: with open(path, "w", encoding="utf-8") as f: json.dump(payload, f, ensure_ascii=False, indent=2) except OSError: pass ``` The storage-root selection includes both the home directory and the system temporary directory: ```python candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) import tempfile candidates.append(os.path.join(tempfile.gettempdir(), "linkfox")) ``` The full response is also always written to a session file: ```python out_path = _resolve_output_path(ts) try: with open(out_path, "w") as f: f.write(serialized) ``` ### Technical Analysis The script stores complete API responses in two places: 1. A 24-hour cache under the current working directory 2. A persistent session output file The output can contain the user's complete shopping prompt, contextual URLs, Alexa responses, product interests, screenshots, and upstream identifiers. Follow-up prompts are specifically designed to ...[truncated 1494 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:469

Finding

Generated API keys are returned in plaintext through stdout and recommended for plaintext shell-profile storage

Content

View full analysis

dict: ... tok = _get_or_generate_api_token( lg["access_token"], lg["user_id"], info["group_id"], ) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` The onboarding instructions recommend commands such as: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The generated API key is embedded in a JSON object and printed directly to stdout. In agent, CI, terminal-recording, or subprocess environments, stdout is commonly retained in conversation transcripts, execution logs, telemetry, or build artifacts. The recommended shell commands additionally place the key in command history and persist it as plaintext in shell startup files. These files may be included in backups, diagnostic bundles, dotfile repositories, or support archives. The API key is necessary for the declared service, but exposing the complete value through routine output and encouraging plaintext persistence exceeds minimum-disclosure principles. ### Attack Path 1. A user completes SMS login through the onboarding script. 2. The ...[truncated 725 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:187

Finding

Skill instructions direct the agent to transmit feedback content without explicit user confirmation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:162

Finding

Runtime dependency installation guidance is unpinned and lacks integrity verification

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ... ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "缺少 requests 依赖，请运行: pip install requests" ) ``` ### Technical Analysis The script instructs users to install `qrcode`, `pillow`, and `requests` from the environment's default Python package index without: - Exact version pins - Hash verification - A lock file - An isolated virtual environment - A documented trusted package index The package names shown are established packages, and no evidence of deliberate typosquatting was identified. Nevertheless, installing mutable latest versions at runtime makes the effective code differ from the audited project and exposes execution to registry compromise, account takeover, malicious mirrors, or incompatible future releases. ### Attack Path 1. The onboarding script encounters a missing dependency. 2. The user follows the displayed `pip install` command. 3. Pip resolves the package from the configured package index or mirror. 4. A compromised release, malicious mirror, or dependency-chain compromise supplies altered code. 5. The package executes with the user's privileges during installation or later import. ### Impact Assessment A malicious dependency can execute arbitrary Python code with the privileges of the user running the Skill, access environment variables containing API keys, read project files, alter outputs, and initiate network requests. Exploitation depends on an upstream package or packag ...[truncated 61 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/amazon_alexa_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The code builds destination URLs from environment-controlled base URLs and then sends sensitive login, token, and account data to them via requests.post. If an attacker can influence environment variables in the runtime, they can redirect SMS-login credentials, access tokens, refresh tokens, and generated API keys to attacker-controlled infrastructure, effectively turning this into credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The gateway URL is also derived from environment variables and used in urllib.request.urlopen with an Authorization header carrying the API key. A hostile environment configuration can redirect authenticated requests, order actions, and account queries to an attacker endpoint, leaking the API key and enabling unauthorized billing or account operations.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as an Amazon Alexa shopping assistant, yet the analyzed behavior includes SMS OTP login, account/token generation, package listing, payment order creation, QR-code payment flows, and payment-status polling. These are materially different privileged actions that can trigger account, billing, and identity operations far beyond the stated user intent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as an Amazon Alexa shopping assistant, yet the analyzed behavior includes SMS OTP login, account/token generation, package listing, payment order creation, QR-code payment flows, and payment-status polling. These are materially different privileged actions that can trigger account, billing, and identity operations far beyond the stated user intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

}

text

## Display Rules

1. **Render the Markdown directly** when `format=markdown`: `stdout` is already structured with turn headings, product cards, and follow-up questions — preserve that structure.
2. **Surface the recommended ASINs** so the user can click through; show `title`, `price`, `score`/`ratingsCount`, and the product URL.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements a full onboarding and monetization workflow—SMS login, API-key issuance, subscription listing, order creation, and payment QR generation—that is unrelated to the advertised Alexa shopping-answer skill. That mismatch is dangerous because it creates hidden account-access and payment capabilities users and reviewers would not reasonably expect from the stated functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code can create paid orders and render payment QR codes despite the skill being described as an Amazon/Alexa shopping-answer integration, not a billing tool. In this context, hidden purchase-enablement capability materially increases risk of unauthorized charges, deceptive monetization, or social engineering through generated payment artifacts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script performs SMS-based account login and can generate or retrieve LinkFox API keys, which is outside the declared Alexa shopping-assistant use case. In context, this is especially dangerous because it grants account bootstrap and secret issuance capabilities that could be abused to seize accounts, provision access, or pivot into other systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill exposes capabilities implying environment access, file writes, and network use, but does not declare an explicit tool scope or permission boundary. That makes it harder for the host agent or reviewer to understand what the skill may access, increasing the chance of over-privileged execution and unexpected data handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are broad enough to match generic Amazon recommendation requests, which can cause unintended invocation of a higher-cost, networked, stateful skill. Overbroad routing increases accidental data sharing and may bypass a more appropriate, lower-privilege tool for the same user need.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description appears to force Chinese-language behavior without user opt-in, which can cause incorrect routing or content transformation against user expectations. While not a direct exploit primitive, it can degrade consent, accuracy, and safe handling of user requests in multilingual contexts.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs persistent logging of full responses into session-scoped files, which can retain user prompts, shopping intent, URLs, recommendations, and other potentially sensitive context across tasks. Session-based aggregation and retained JSON artifacts increase the blast radius of accidental disclosure, later misuse, or cross-task data leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 74)May include surrounding context.

}

text

## curl 示例

**Markdown 格式（默认）：**

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation includes a separate feedback-submission endpoint that is unrelated to the primary shopping-query capability, which expands the skill's effective behavior beyond what a caller would reasonably expect. This can enable unsolicited transmission of user content or conversation summaries to a third-party service, creating privacy, consent, and data-governance risks if an agent automatically follows the docs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The onboarding flow instructs the operator to collect a user's phone number and pass it into a registration script, but it provides no privacy notice, consent language, retention limits, or warning about how that personal data will be handled. In an agent skill context, this increases the risk of unnecessary collection, disclosure, or mishandling of personally identifiable information during support and authentication recovery.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module documentation says writing to /tmp is forbidden and that a non-writable current directory should cause an error, but the implementation silently falls back to the home directory and then the system temp directory. This mismatch can cause sensitive Alexa responses and session metadata to be stored in locations operators explicitly believed would never be used, undermining security assumptions and potentially exposing data on shared systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill creates persistent session directories and metadata files, and elsewhere always writes full Alexa API responses to disk. Because the skill description focuses on retrieval of answers and recommendations rather than local retention, this creates an undisclosed data-at-rest exposure: prompts, URLs, recommendations, and session identifiers may remain on disk longer than users or integrators expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script always serializes and writes the full API response to disk before deciding what to print. Since Alexa shopping queries and responses may contain user prompts, browsing context URLs, product interests, and other potentially sensitive session data, unconditional persistence increases the attack surface for local disclosure, especially on multi-user hosts or developer workstations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The QR rendering path writes payment QR image files into workspace/home/temp directories without surfacing a direct warning in the command flow. In an agent or shared execution environment, those files may persist, be discoverable by other processes/users, or leave behind sensitive payment artifacts beyond the user’s awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This is a real external transmission point because the function sends login and token-related data over the network, and the destination can be influenced by environment configuration. In the context of a mislabeled skill with hidden onboarding capabilities, this network egress is more dangerous because it supports covert exfiltration of sensitive account data.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The SMS verification and login flow enforce an 11-digit phone format and fixed area code "+86", which constrains the skill to a specific locale. The natural-language help and code do not offer locale choice or clearly justify this restriction as a region-specific tool, so this is a language/locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code generates or retrieves an API key and returns it directly in stdout JSON without any in-file warning, masking, or safer secret-delivery mechanism. That increases the chance of accidental disclosure through logs, transcripts, tool outputs, or downstream agent memory, especially in an agent-skill environment where outputs are often captured.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The feedback API example uses a different skill name than the current skill, which can cause misrouting of telemetry or feedback to the wrong integration. While not directly exploitable for code execution, it undermines traceability and can result in incorrect data association, confusing audits and incident response.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.