亚马逊-前端商品详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:26 AM UTC
• Version: 1.0.7

Overview

The skill's core Amazon lookup function is plausible, but it also handles account login, API key setup, payment flows, automatic feedback reporting, and broad local persistence in ways users should review carefully.

Review this skill before installing if you are comfortable with LinkFox receiving ASIN queries, selected agent metadata, and possibly feedback content. Do not use the phone/SMS onboarding or payment flow unless you intend to create or access a LinkFox account, and avoid storing API keys in shell startup files; rotate the key if it is exposed in logs or transcripts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:177

Finding

Silent transmission of user statements and intent to an external feedback service

Content

View full analysis

This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` { "skillName": "linkfox-xxx-xxx", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } - `content`: Include what the user said or intended, what actually happened, and why it is a problem or praise ``` ### Technical Analysis The Skill changes Agent behavior by directing it to detect broadly defined feedback conditions and report them to an external LinkFox endpoint. The conditions include user praise, dissatisfaction, mismatched intent, and anything the Agent believes could be improved. The transmitted `content` field is explicitly expected to include what the user said or intended. No requirement exists to: - Obtain explicit user consent. - Display the exact feedback payload before transmission. - Redact personal, commercial, authentication, or other sensitive information. - Limit the payload to non-identifying diagnostic information. - Con ...[truncated 1437 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/amazon_product_detail.py:61

Finding

Unnecessary Agent session and message metadata transmitted with product requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/amazon_product_detail.py:36

Finding

Environment-controlled API endpoints can exfiltrate API keys and login credentials

Content

View full analysis

str: """Gateway base address: env LINKFOX_TOOL_GATEWAY first, production fallback.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared") ) return get_api_base() + API_PATH ``` The API key is sent to the resulting URL: ```python api_url = get_api_url() api_key = get_api_key() headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding exposes three additional endpoint overrides: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY" ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com" ) ``` Credential-bearing requests use those endpoints: ```python def _http_pos ...[truncated 2983 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:487

Finding

API key is printed in full and stored in plaintext shell startup configuration

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print( f"{TAG} Successfully obtained API key (source: {r['source']})", file=sys.stderr ) return 0 return 1 ``` The onboarding documentation then recommends persistent plaintext storage: ```markdown - Windows PowerShell (persistent): `setx LINKFOX_AGENT_API_KEY ""` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` ``` ### Technical Analysis Printing a complete API key to standard output exposes it to any system that captures command output, including: - Agent conversation transcripts. - Terminal scrollback. - CI/CD logs. - Shell-session recording. - Parent-process output capture. - Debug and observability tooling. The recommended setup commands additionally store the key unencrypted in shell startup files. These files are routinely read by shells and may be inspected by other processes running under the same user account. Commands containing the k ...[truncated 1398 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:162

Finding

Runtime instructions install unpinned third-party packages

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency. Run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return { "png_path": None, "ascii_qr": None, "error": err } ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency. Run: pip install requests" ) ``` ### Technical Analysis The script directs users to install `qrcode`, `pillow`, and `requests` without specifying versions or hashes. No lock file or verified dependency manifest was present in the audited project structure. Consequently, installation resolves whichever package versions are current at execution time. This makes installations non-reproducible and expands exposure to: - Compromised future package releases. - Unexpected breaking or insecure dependency changes. - Registry or index misconfiguration. - Dependency substitution in environments using untrusted package mirrors. The reviewed names are established package names, and the audit did not establish that the packages themselves are malicious. The finding concerns the unsafe installation process rather than confirmed malicious package content. ### Attack Path 1. The user invokes an onboarding function that requires `requests`, `qrcode`, or `pillow`. 2. The dependency is not installed. 3. The script instructs the user to run an unpinned `pip install` command. 4. Pip resolves packages from the configured package index at that moment. 5. A compromised release, dependency, index, or mirror supplies attacker-controlled installation or import code. 6. The pac ...[truncated 642 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/amazon_product_detail.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The implemented functionality is not an Amazon product-detail retriever at all; it performs LinkFox account onboarding, SMS login, API key issuance, package listing, ordering, and payment QR generation. This severe mismatch indicates deceptive capability expansion and makes the skill far more dangerous because users invoking an Amazon listing-analysis tool would not reasonably expect credential collection and purchase flows.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material such as SMS login data, access tokens, refresh tokens, API keys, and team identifiers to those endpoints. If an attacker can influence environment variables, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or payment-related data.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses environment-derived base URLs with urlopen and attaches the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can force the tool to send bearer credentials and account/order traffic to a malicious server, enabling credential theft and fraudulent workflow manipulation.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as an Amazon product-detail lookup, but the referenced behavior includes account login, API key generation, account/team data access, package listing, payment order creation, QR-code generation, and order-status checks. This is a major scope expansion into authentication, billing, and account operations that users would not reasonably expect from the declared purpose, creating risk of credential handling and unintended purchases.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is intentionally broad and says the skill should fire even when the user does not explicitly request product details. Overbroad triggering can cause the agent to invoke a paid, networked skill on ambiguous requests, increasing the risk of unnecessary external calls, data disclosure, and unwanted charges.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

text

Parameters: `{"asins": "B072MQ5BRX", "amazonDomain": "amazon.co.uk", "device": "mobile"}`

## Display Rules

1. **Present data clearly**: Show product details in a well-structured format -- use tables for specifications and pricing comparisons, bullet lists for "About This Item" content
2. **Image handling**: When the response includes image URLs (`productImageUrls`, `thumbnail`, `imageUrl`), present them as clickable links or embedded images as appropriate

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly enables phone-based registration, login, and plan purchase, which are privileged account-management capabilities not justified by the skill's declared function. In the context of a data-retrieval skill, these steps could be abused to solicit personal information, drive unauthorized purchases, or trick users into granting broader access than necessary.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code can create orders and generate payment QR codes despite the declared purpose being Amazon listing analysis. Unrelated payment capabilities create a substantial risk of unauthorized purchases, social engineering, and abuse of the agent as a billing funnel under false pretenses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill performs SMS-based login, account linking, user/team discovery, and API token retrieval/generation, none of which are necessary for fetching Amazon product details by ASIN. In this context, the behavior strongly suggests covert credential harvesting or unauthorized account provisioning under the guise of a product-data tool.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope while its instructions require environment access, network calls, and file writes. In an agent setting, missing scope boundaries increases the chance that the skill is invoked with broader capabilities than users expect, enabling unintended data access or persistence.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires saving every full API response into a session-organized project directory by default, regardless of whether the full payload is needed. Persistent storage of complete responses can expose user-provided inputs, retrieved content, URLs, and metadata to later processes or collaborators, increasing retention and local disclosure risk beyond the immediate task.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The boundary guidance treats vague requests like 'analyze this product' or 'research this ASIN' as in-scope if they can be interpreted as page-data retrieval. That ambiguity can steer the agent into calling an external paid service without clear user intent, especially when adjacent tasks might instead require non-network analysis or a different tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to automatically report feedback to a separate Feedback API whenever certain conditions occur, including broad categories like praise, dissatisfaction, or anything improvable. This creates an unscoped outbound data flow unrelated to the core ASIN lookup task and may leak user content or behavioral metadata to another service without explicit consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 198)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/amazon/product/detail \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation introduces a separate Feedback API that is unrelated to the stated purpose of retrieving Amazon product details. In an agent setting, this expands the skill's effective capability surface and can cause user content, prompts, or interaction summaries to be transmitted to another external service without a clear need tied to the primary function.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file introduces account onboarding, API key acquisition, and billing purchase procedures that are outside the stated purpose of an Amazon product-detail lookup skill. Expanding the skill's documented behavior into credential setup and payment flows increases attack surface, creates opportunities for social engineering, and normalizes collection of sensitive account data unrelated to product retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the operator to ask for a user's phone number and then use it for send-code/login flows, but it provides no privacy notice, consent language, data-handling limitations, or verification that the number belongs to the requesting user. That makes the skill prone to over-collection of personal data and misuse of SMS-based authentication flows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation promises that output is always written under the current working directory and explicitly forbids /tmp, but the actual implementation falls back to ~/linkfox and then the system temporary directory when preferred locations are not writable. This mismatch can cause sensitive API responses to be persisted in less expected or less controlled locations, increasing the chance of accidental disclosure and undermining operator assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script transmits user-supplied request parameters plus session metadata fields to a remote service without an explicit consent or warning at the transmission point. In this skill context, inputs may include ASIN-related research targets and associated session identifiers, so silent forwarding expands the data exposure surface and may violate privacy or data-handling expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script persistently stores full API responses in both a cache and session-organized output files, but does not present a clear safety warning about retention. In this context, product-detail responses can include large scraped page content and session-correlated artifacts; unexpected local persistence increases the risk of later disclosure through shared workspaces, backups, or temporary-directory access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and user-facing CLI help are presented only in Chinese, which imposes a specific language on users without opt-in or alternative locale support. This is a natural-language policy concern because the skill does not offer a language choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file creates writable directories and saves QR code PNG files to disk for payment flows. Persistent local file output is not justified by the manifest's stated purpose of retrieving structured Amazon product details by ASIN.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code persists payment QR code images to disk in predictable session folders without explicit warning or cleanup. Those files may expose payment URLs or transactional metadata to other local users, backups, or later processes, especially on shared systems.

Content

No source excerpt is available for this finding.