T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:182- Finding
Silent Disclosure of User Statements and Intent Through the Feedback API
- Content
View full analysis
- Remediation
View remediation
Security audit
亚马逊-商品评论
Security checks for vulnerabilities and agentic risk
Overview
This Amazon reviews skill performs the expected review retrieval, but it also includes under-disclosed account, billing, credential, and automatic feedback-reporting behavior that users should review carefully.
Install only if you are comfortable with a paid LinkFox integration that may handle phone/SMS onboarding, API keys, account/team details, plan purchases, payment links, persistent local result files, and automatic feedback reporting. Avoid using it in sensitive workspaces unless feedback is made explicit opt-in, API origins are pinned to trusted LinkFox HTTPS hosts, and credentials are stored in a proper secret manager rather than shell startup files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/amazon_reviews.py:46- Finding
API Credential and Session Metadata Exfiltration Through a Configurable Gateway
- Content
View full analysis
str: """Gateway base address: the environment variable takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(path): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + path ``` ```python def call_api(path, params, timeout=30): api_url = get_api_url(path) api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "Accept": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` ### Technical Analysis The request destination is derived directly from `LINKFOX_TOOL_GATEWAY`. The code does not enforce HTTPS, validate the hostname against an allowlist, reject embedded URL credentials, or otherwise establish that the destination is operated by LinkFox. After accepting the destination, the code transmits: - The reusable LinkFox API credential in the `Authorization` header. - `SESSION_ID`. - `MESSAGE_ID`. - `MODE_ID`. - `APP_NAME`. - The complete review request, including ASIN and filtering terms. Only the API credential and review parameters are arguably needed to use the declared service. Sending Agent/session correlation metadata exceeds the minimum information required for Amazon review retrieval. ...[truncated 1271 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/onboarding.py:71- Finding
Onboarding Tokens, SMS Data, and API Keys Can Be Redirected to Arbitrary Endpoints
- Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Authentication headers are subsequently attached to requests: ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID if group_id: h["tid"] = group_id return h ``` The token-bearing calls include: ```python resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) ``` ```python resp = _http_post(f"{_login_base()}/linkFoxApp/api/userCenter/userInfo", {}, _headers("ag ...[truncated 2307 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/onboarding.md:9- Finding
SMS Verification Codes and Generated API Keys Are Exposed Through Process Arguments and Output
- Content
View full analysis
` → display the phone and agreement fields from the JSON - After receiving the code: `python scripts/onboarding.py login` - After obtaining the `api_key`, forward the following configuration instructions: - Windows PowerShell: `setx LINKFOX_AGENT_API_KEY ""` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` ``` The successful login result includes the complete generated key: ```python return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The result is printed without redaction: ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} successfully obtained API key", file=sys.stderr) return 0 return 1 ``` ### Technical Analysis Command-line arguments can be retained in shell history and may be visible in process inspection tools while the command runs. Consequently, the phone number and short-lived SMS verification code can be exposed to local users, monitoring agents, terminal recorders, or CI systems. The generated API key is emitted in full to stdout. Agent runtimes and automation systems commonly capture stdout in transcrip ...[truncated 1369 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/onboarding.py:163- Finding
Unpinned Runtime Installation of Third-Party Python Packages
- Content
View full analysis
dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The script directs users to install `qrcode`, `pillow`, and `requests` without version constraints, integrity hashes, a lock file, or a trusted index configuration. Package resolution therefore depends on the user's active pip configuration and whatever versions are current at installation time. The package names shown are legitimate and no malicious package is embedded in the audited project. The risk is the unsafe installation process: a compromised package release, manipulated package index, dependency substitution, or future incompatible release could introduce code that executes during installation or import. ### Attack Path 1. The user invokes onboarding in an environment where one of the modules is missing. 2. The script returns an instruction to run an unconstrained `pip install` command. 3. The user's pip configuration resolves packages from a compromised, substituted, or untrusted index, or selects a compromised future release. 4. Package installation or import executes attacker-controlled code under the user's account. 5. That code may access the same environment variables and credentials used by the onboarding process. ### Impact Assessment A compromised Python dependency executes with the privileges of the user running pip or the onboarding script. It may ...[truncated 330 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (32)
Tainted flow: 'req' from os.environ.get (line 84, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method="POST", ) try: with urlopen(req, timeout=timeout) as response: result = _parse_api_response(response.read(), path) cost_token = response.headers.get("X-Cost-Token") if isinstance(result, dict) and cost_token is not None:
Description-Behavior Mismatch
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file’s functionality is fundamentally unrelated to the declared Amazon reviews skill: it performs phone-based login, token handling, API-key generation, package listing, purchasing, and payment QR creation for LinkFox. This strong capability mismatch is dangerous because it disguises account onboarding and monetization behavior inside an unrelated skill, increasing the chance of covert credential capture and unauthorized billing flows.
- Content
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The POST target URL is derived from environment-controlled base URLs, so a user or hosting environment can redirect authentication and onboarding traffic to an attacker-controlled endpoint. Because these requests carry SMS-login data, access tokens, refresh tokens, and API-token generation flows, this becomes an exfiltration and SSRF-style risk rather than a harmless configuration feature.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The gateway URL is also built from environment variables and then used in urlopen with Authorization headers containing the API key. An attacker who can influence environment configuration can cause the CLI to send secrets and account/order operations to an arbitrary host, exposing credentials and enabling unauthorized transaction flow manipulation.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
If the referenced onboarding flow includes account login, API-key issuance, account/team lookup, pricing, and payment/order operations, then the skill’s declared purpose materially understates financially and identity-sensitive capabilities. Hidden or indirectly invoked billing and authentication workflows raise the risk of credential handling, account actions, and purchases outside the user's clear expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the referenced onboarding flow includes account login, API-key issuance, account/team lookup, pricing, and payment/order operations, then the skill’s declared purpose materially understates financially and identity-sensitive capabilities. Hidden or indirectly invoked billing and authentication workflows raise the risk of credential handling, account actions, and purchases outside the user's clear expectations.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
{"asin": "B0FP5C63HZ", "domainCode": "com", "star3Num": 100}
text ## Display Rules 1. **Present data clearly**: Show reviews grouped by star rating with key fields: rating, title, text, date, verified status, helpful count. 2. **Summarize when appropriate**: For many reviews, provide a theme/pain-point summary before listing individuals.
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This onboarding document adds account registration, login, API key provisioning, and billing workflows that are not necessary for an Amazon review analysis skill’s stated purpose. Embedding unrelated credential acquisition and payment enablement expands the skill’s effective scope, increases the chance the agent will solicit secrets or money from users, and creates an avenue for misuse if triggered during ordinary support flows.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document instructs the agent to collect a phone number, send verification codes, log in, and help initiate plan purchases, none of which are justified by fetching or analyzing Amazon reviews. In skill context, this is especially dangerous because it normalizes off-purpose identity and payment handling, enabling phishing-like behavior or unauthorized account creation under the guise of troubleshooting.
- Content
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md 示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Authentication and purchase capabilities are unjustified in the context of an Amazon review analysis skill and materially increase risk by collecting phone numbers, SMS codes, API keys, and payment actions. In-context, these features are more dangerous because users invoking a benign-seeming review skill would not reasonably expect account enrollment or order/payment operations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and operationalizes network access, environment-variable use, and persistent file writes without declaring any explicit tool scope or permissions boundary. That creates an authorization gap: a reviewer or runtime may underestimate what the skill can do, increasing the chance of unintended data access, exfiltration, or filesystem modification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger logic is intentionally broad and says the skill should activate even when the user does not explicitly mention reviews, as long as the request loosely involves reading, filtering, or analyzing buyer feedback. Overbroad triggering can cause the agent to invoke this networked, stateful skill in contexts where the user did not intend external retrieval or local storage, increasing unnecessary data exposure and spend.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill mandates persistent local storage of the full response in a session-scoped directory and explicitly forbids temporary storage, even when only a summary is needed. That increases retention of potentially sensitive or proprietary marketplace data and expands the blast radius if the workspace is shared, synced, or later accessed by other tools or users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The primary API reference is written entirely in Chinese, which can function as a language constraint for operators or downstream agent behavior if this skill is expected to be generally usable. The file does not indicate that Chinese is an optional locale or that the skill is limited to a Chinese-speaking or region-specific context.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md POST Body（JSON）： | 参数 | 类型 | 必填 | 说明 | |------|------|------|--------------------------------------------------------------------------------------------------------------------------------| | asin | string | 是 | 亚马逊商品ASIN | | domainCode | string | 否 | 亚马逊域名代码，默认 `com`。可选值：`com`、`ca`、`co.uk`、`in`、`de`、`fr`、`it`、`es`、`co.jp`、`com.au`、`com.br`、`nl`、`se`、`com.mx`、`ae`。美国站使用 `com` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 参数 | 类型 | 必填 | 说明 | |------|------|------|--------------------------------------------------------------------------------------------------------------------------------| | asin | string | 是 | 亚马逊商品ASIN | | domainCode | string | 否 | 亚马逊域名代码，默认 `com`。可选值：`com`、`ca`、`co.uk`、`in`、`de`、`fr`、`it`、`es`、`co.jp`、`com.au`、`com.br`、`nl`、`se`、`com.mx`、`ae`。美国站使用 `com` | | star1Num | integer | 否 | 1星评论数量，默认获取10条，最多100条 | | star2Num | integer | 否 | 2星评论数量，默认获取10条，最多100条 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |------|------|------|--------------------------------------------------------------------------------------------------------------------------------| | asin | string | 是 | 亚马逊商品ASIN | | domainCode | string | 否 | 亚马逊域名代码，默认 `com`。可选值：`com`、`ca`、`co.uk`、`in`、`de`、`fr`、`it`、`es`、`co.jp`、`com.au`、`com.br`、`nl`、`se`、`com.mx`、`ae`。美国站使用 `com` | | star1Num | integer | 否 | 1星评论数量，默认获取10条，最多100条 | | star2Num | integer | 否 | 2星评论数量，默认获取10条，最多100条 | | star3Num | integer | 否 | 3星评论数量，默认获取10条，最多100条 | | star4Num | integer | 否 | 4星评论数量，默认获取10条，最多100条 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |------|------|------|--------------------------------------------------------------------------------------------------------------------------------| | asin | string | 是 | 亚马逊商品ASIN | | domainCode | string | 否 | 亚马逊域名代码，默认 `com`。可选值：`com`、`ca`、`co.uk`、`in`、`de`、`fr`、`it`、`es`、`co.jp`、`com.au`、`com.br`、`nl`、`se`、`com.mx`、`ae`。美国站使用 `com` | | star1Num | integer | 否 | 1星评论数量，默认获取10条，最多100条 | | star2Num | integer | 否 | 2星评论数量，默认获取10条，最多100条 | | star3Num | integer | 否 | 3星评论数量，默认获取10条，最多100条 | | star4Num | integer | 否 | 4星评论数量，默认获取10条，最多100条 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |------|------|------|--------------------------------------------------------------------------------------------------------------------------------| | asin | string | 是 | 亚马逊商品ASIN | | domainCode | string | 否 | 亚马逊域名代码，默认 `com`。可选值：`com`、`ca`、`co.uk`、`in`、`de`、`fr`、`it`、`es`、`co.jp`、`com.au`、`com.br`、`nl`、`se`、`com.mx`、`ae`。美国站使用 `com` | | star1Num | integer | 否 | 1星评论数量，默认获取10条，最多100条 | | star2Num | integer | 否 | 2星评论数量，默认获取10条，最多100条 | | star3Num | integer | 否 | 3星评论数量，默认获取10条，最多100条 | | star4Num | integer | 否 | 4星评论数量，默认获取10条，最多100条 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |------|------|------|--------------------------------------------------------------------------------------------------------------------------------| | asin | string | 是 | 亚马逊商品ASIN | | domainCode | string | 否 | 亚马逊域名代码，默认 `com`。可选值：`com`、`ca`、`co.uk`、`in`、`de`、`fr`、`it`、`es`、`co.jp`、`com.au`、`com.br`、`nl`、`se`、`com.mx`、`ae`。美国站使用 `com` | | star1Num | integer | 否 | 1星评论数量，默认获取10条，最多100条 | | star2Num | integer | 否 | 2星评论数量，默认获取10条，最多100条 | | star3Num | integer | 否 | 3星评论数量，默认获取10条，最多100条 | | star4Num | integer | 否 | 4星评论数量，默认获取10条，最多100条 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |------|------|------|--------------------------------------------------------------------------------------------------------------------------------| | asin | string | 是 | 亚马逊商品ASIN | | domainCode | string | 否 | 亚马逊域名代码，默认 `com`。可选值：`com`、`ca`、`co.uk`、`in`、`de`、`fr`、`it`、`es`、`co.jp`、`com.au`、`com.br`、`nl`、`se`、`com.mx`、`ae`。美国站使用 `com` | | star1Num | integer | 否 | 1星评论数量，默认获取10条，最多100条 | | star2Num | integer | 否 | 2星评论数量，默认获取10条，最多100条 | | star3Num | integer | 否 | 3星评论数量，默认获取10条，最多100条 | | star4Num | integer | 否 | 4星评论数量，默认获取10条，最多100条 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | star3Num | integer | 否 | 3星评论数量，默认获取10条，最多100条 | | star4Num | integer | 否 | 4星评论数量，默认获取10条，最多100条 | | star5Num | integer | 否 | 5星评论数量，默认获取10条，最多100条 | | filterByKeyword | string | 否 | 按关键词筛选评论，最大长度1000字符 | | sortBy | string | 否 | 评论排序方式：`recent`（最新评论）或 `helpful`（最有用评论），默认 `recent` | | reviewerType | string | 否 | 评论者类型：`all_reviews`（所有评论）或 `avp_only_reviews`（仅认证购买），默认 `all_reviews` | | mediaType | string | 否 | 媒体类型：`all_contents`（所有内容）或 `media_reviews_only`（仅包含媒体的评论），默认 `all_contents` |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
}
text ## curl 示例（美国站） ### 1. 提交
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document introduces a separate feedback-reporting API that is unrelated to the stated core purpose of fetching and analyzing Amazon reviews. This expands the skill’s data-flow surface and can cause an agent to transmit user-derived content to a second external endpoint without a clear functional need or explicit user awareness.
- Content
Static analysis
No suspicious patterns detected.