亚马逊-机会报告

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.8

Overview

The skill can generate Amazon market reports, but it also includes sensitive login, API-key, payment-order, and persistent local-save behavior that is broader than the main description.

Review this skill before installing. Use it only if you are comfortable giving LinkFox credentials and, when needed, a phone/SMS login flow to the agent. Prefer self-service API-key setup when possible, verify any payment plan and QR order before paying, avoid overriding LinkFox endpoint environment variables, and clean up saved linkfox response/cache files if they contain sensitive business research.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material such as SMS login data, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or perform SSRF-style outbound access.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway helper constructs outbound urllib requests using a base URL derived from environment variables and attaches the API key in the Authorization header. An attacker who controls those environment variables could redirect paid-order, package, or account requests to a malicious host and capture the API key or induce unexpected outbound connections.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation describes use of environment variables, network access, and local file writes, but no explicit permission model or user-consent boundary is declared. That creates an authority gap: a seemingly simple reporting skill can access credentials and persist data locally without transparent scoping, increasing the risk of unintended data exposure or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is keyword-based Amazon market reporting, but the static finding indicates the skill ecosystem also performs phone-based login, API-key acquisition, package lookup, order creation, QR-code payment generation, and payment-status polling. This is a major behavior expansion into authentication and billing flows that users would not reasonably expect from a market-insight skill, creating risk of credential harvesting, unauthorized purchases, or deceptive workflow escalation.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module documentation promises that data will not be written to `/tmp` and that failure to write to the current directory will cause an error, but the implementation actually falls back to the home directory and then the system temp directory. This mismatch can cause sensitive API responses to be stored in less protected or unexpected locations, undermining operator assumptions about data handling.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS authentication, API key retrieval, subscription browsing, order creation, and payment QR generation, none of which align with the declared purpose of generating Amazon keyword opportunity reports. That mismatch materially increases risk because the skill is requesting users to perform sensitive account and billing actions under a misleading capability description.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can obtain or generate API tokens for a user account, which is a powerful account-management action unrelated to the stated report-generation purpose. In the context of a misleading skill, this capability could be abused to mint credentials that enable later API access beyond the user’s expectation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The package listing, order creation, and payment QR code features enable direct billing and purchasing workflows that are unrelated to an Amazon keyword analysis/report skill. Because the skill context does not justify commerce operations, these capabilities create deception and unauthorized-charge risk if users are led into purchases they did not reasonably expect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to always write full API responses to disk in a session-linked path, but does not provide a clear user-facing warning or opt-in for local persistence. Even if the data is business-oriented, full responses may contain user-supplied keywords, account-linked metadata, cost details, or generated content that remains on disk longer than expected and could be accessed by other processes or users.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs operators to collect a user's phone number and send it through a registration script without any explicit privacy notice, consent language, retention limits, or data-handling safeguards. This creates a real privacy and compliance risk because personally identifiable information is being processed through an agent-mediated flow with no documented disclosure or minimization.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script persistently writes the full API response to disk by default, and the response may contain market research inputs, generated analysis, or tenant-specific metadata. Automatic retention increases the chance of unintended disclosure through shared workspaces, backups, or insecure temp/home-directory fallback behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The login path emits the user's API key directly to stdout JSON, which may be captured by logs, calling frameworks, shell history workflows, or other tools that ingest command output. Exposing long-lived credentials in normal output substantially increases the chance of accidental leakage and downstream account compromise.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Persisting full API responses under a session-correlated local path creates a durable data trail beyond the immediate conversation. This increases exposure of report contents and metadata across sessions, especially in shared workspaces or repositories, and is made more dangerous here because the save behavior is mandatory rather than exceptional.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill creates a natural-language workflow where the agent asks for a phone number, processes an SMS login flow, and relays account-related outputs such as an API key back to the user. This is dangerous because it normalizes handling sensitive identifiers and credentials in conversational channels, increasing the risk of leakage through logs, transcripts, screenshots, or operator error.

Static analysis

No suspicious patterns detected.