亚马逊-机会筛选

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.6

Overview

The skill mostly does the advertised Amazon niche search, but it also includes sensitive account, API-key, billing, automatic feedback, and local persistence behavior that needs careful review.

Install only if you are comfortable giving this skill a LinkFox API key and, during error recovery, potentially using phone-number login and payment flows. Confirm the gateway-related environment variables point to legitimate LinkFox domains, avoid placing sensitive query data in shared repositories, and treat automatic feedback reporting as external telemetry unless disabled or controlled by the host.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The script builds a request using environment-controlled configuration, including the gateway base URL and multiple identifiers, and then sends the request with an Authorization header to that destination. If an attacker can influence environment variables such as LINKFOX_TOOL_GATEWAY, they can redirect authenticated traffic and potentially capture API keys, request data, and session metadata.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code sends authentication data and tokens to URLs whose base components are taken from environment variables via _login_base() and _agent_user_base(), then used by requests.post without any allowlist or verification. In a skill/runtime environment where env vars can be influenced by a host, wrapper, or attacker, this enables exfiltration of SMS login credentials, access tokens, refresh tokens, and generated API keys to attacker-controlled endpoints.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request URL is built from environment-controlled base URLs and then passed to urllib.request.urlopen along with the Authorization header containing LINKFOX_AGENT_API_KEY. If an attacker can influence the environment, they can redirect these requests to an arbitrary server and capture API keys or manipulate billing/order responses.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents access to environment variables, network APIs, and unconditional file writes, yet no explicit permission model or user-consent boundary is declared. This creates a capability gap where a caller may invoke a seemingly narrow niche-search skill without understanding it can read secrets and persist API responses locally, increasing the risk of unintended data exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is Amazon niche screening, but the documented/observed behavior extends into SMS login, API-key generation, account/team access, package lookup, paid order creation, QR-code payment generation, and payment-status polling. This is a severe scope expansion that can drive authentication, billing, and account actions unrelated to the user's selection query, creating clear risk of unauthorized account access, secret issuance, and financial charges.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically report user reactions, mismatches, and improvement opportunities to a Feedback API even though that behavior is not necessary for running a niche-metrics search. Auto-exfiltrating interaction metadata to a secondary endpoint can leak user intent, satisfaction signals, and possibly query contents without meaningful consent or necessity.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file documents a secondary Feedback API that is unrelated to the core reverse product-search function, creating an unexpected external data flow path inside the skill. In agent settings, this can lead to user content or conversation summaries being sent to a separate service without clear necessity, expanding the attack surface and enabling covert telemetry or privacy leakage.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file embeds authentication, account registration, and billing workflows inside a skill whose stated purpose is Amazon niche/opportunity search. That scope expansion is risky because it conditions the agent to collect credentials/phone numbers and guide payments, creating an opportunity for abuse, phishing, or unauthorized account operations unrelated to the advertised task.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring promises writes are confined to <cwd>/linkfox and explicitly forbids /tmp, but the implementation falls back to the home directory and then the system temp directory. This mismatch can cause sensitive API responses to be stored in less controlled locations than operators expect, undermining data-handling assumptions and potentially exposing data through shared or weakly monitored paths.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill is described as an Amazon reverse niche search capability, but the code implements account onboarding, SMS login, API-key retrieval, subscription management, ordering, and payment QR generation. That mismatch is dangerous because it expands the trust boundary and collects credentials/payment-related data unrelated to the declared skill purpose, a classic sign of covert capability insertion.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code creates orders, queries payment state, and renders payment QR codes despite the skill's stated purpose being metrics-based Amazon opportunity search. Unrelated billing functionality can be abused to induce unauthorized purchases or funnel users into payment flows under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script performs SMS-based login, obtains access and refresh tokens, queries account/team information, and generates API tokens, all beyond the stated niche-search purpose. This is highly sensitive identity and credential-handling logic that could be used to harvest or mint long-lived credentials under the guise of a benign market-research skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill warns about point cost but states that full API responses are always written to the current working directory, while failing to provide equivalent disclosure about this persistence risk. Because responses may contain query details, business criteria, and service metadata, mandatory local storage in the project directory can expose sensitive or proprietary user data to other tools, collaborators, or version-control mistakes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Feedback API guidance instructs sending free-form `content` externally but does not warn that this may contain user-provided text, intents, or sensitive context. In an agent workflow, this omission can cause operators or downstream implementations to exfiltrate conversation data to a third-party endpoint without informed consent or proper filtering.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions explicitly ask for a user's phone number and use it in registration/login commands, but provide no privacy notice, retention limits, masking guidance, or warning about sensitive-data handling. In an agent setting, this increases the chance of unnecessary collection and exposure of personal data during support interactions.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script sends user-supplied parameters plus SESSION_ID, MODE_ID, and APP_NAME to a remote service without explicit runtime disclosure or consent handling. In a skill context, these fields may reveal user, workflow, or project metadata, so silent transmission increases privacy risk and makes accidental data leakage more likely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script persistently writes full API responses to disk on every run by default, which can capture business-sensitive query results, identifiers, or server-returned metadata. Default-at-rest storage increases the blast radius of local compromise and can leak data through backups, shared workspaces, or later accidental disclosure.

Static analysis

No suspicious patterns detected.