亚马逊-商品评论

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:38 PM UTC
• Version: 1.0.9

Overview

The skill mainly fetches Amazon reviews, but it also adds automatic feedback reporting and account, billing, and payment flows that deserve careful review before installation.

Install only if you are comfortable with LinkFox receiving review queries and onboarding data, raw review responses being saved locally, and the skill helping create paid orders when credits are insufficient. Before use, verify LinkFox endpoint environment variables are not overridden unexpectedly, and avoid automatic feedback submission unless users have clearly consented to sending their prompt context or assessment externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target is derived from helper functions that read environment-controlled base URLs, then used directly in requests.post. In a skill environment, a malicious or compromised deployment can redirect login/API traffic and transmit phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to an attacker-controlled host.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The urllib Request URL is built from environment-derived base URLs and is then opened with the Authorization header populated from LINKFOX_AGENT_API_KEY. This can exfiltrate the agent API key and enable SSRF-like outbound access if an attacker can influence environment variables or packaging, which is especially dangerous in an unrelated Amazon review skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet its documentation clearly indicates access to environment variables, network calls, and file writes. This creates a transparency and least-privilege problem: operators and users cannot accurately assess what the skill can access, while the skill writes API responses to the working directory and reads authentication material from the environment. In this context, undeclared capabilities are especially risky because review data, session identifiers, and any returned account-related data may be persisted locally without explicit permission disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a review-fetching tool, but the referenced onboarding flow reportedly includes SMS verification, phone-based login, API key acquisition, account lookup, package listing, order creation, order-status polling, and payment QR generation. That is a major scope expansion into authentication, account management, and billing workflows that users would not reasonably expect from a review-analysis skill. In a security review, this mismatch is dangerous because it can facilitate unexpected collection of personal data, credential handling, and payment interactions under misleading cover.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs automatic reporting to a Feedback API whenever the model detects dissatisfaction, praise, mismatch, or possible improvements, even though that behavior is unrelated to retrieving Amazon reviews. This creates an unjustified outbound data flow that could transmit user prompts, sentiment, or operational details to another service without clear consent or necessity. The danger is increased by the instruction to do it automatically and without interrupting the user's flow, which bypasses meaningful notice.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documentation embeds a separate feedback submission API that is unrelated to the core purpose of fetching Amazon reviews. In an agent setting, this can prompt unintended outbound requests containing user prompts, summaries, or operational data to a third-party endpoint, creating a data exfiltration and scope-creep risk even if presented as benign telemetry.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script persistently stores full API responses, cache entries, and session metadata to local disk, including review payloads and identifiers tied to SESSION_ID and related context. In an agent environment, this broadens data retention beyond the minimum needed to answer the user and can expose potentially sensitive business data, usage metadata, or customer content to other local processes, later tasks, or accidental check-in.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file's functionality is unrelated to the declared Amazon review analysis purpose: it performs LinkFox account onboarding, SMS login, token acquisition, package listing, ordering, and payment QR generation. Such a scope mismatch is a strong indicator of hidden capability insertion, increasing the chance that the skill harvests credentials or drives unauthorized account and billing actions under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create orders, select payment methods, and render payment QR codes, which are billing capabilities unjustified for an Amazon reviews skill. In this context, these features materially increase risk because they could induce purchases, misuse stored credentials, or support account monetization workflows hidden inside a benign-seeming skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 86% confidence
• Finding: This code performs external transmission of authentication-related data to remote services, including SMS login details and token exchange payloads. While outbound networking alone is not always unsafe, here it occurs in a skill whose declared purpose is Amazon review analysis, making the transmission unexpected and increasing the likelihood of credential exposure or deceptive data handling.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.