亚马逊-以图搜图

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:38 PM UTC
• Version: 1.0.6

Overview

The skill’s Amazon image search function is legitimate, but it also handles authentication, API keys, public image uploads, feedback reporting, and payment-order flows with incomplete consent and scoping.

Review this skill carefully before installing. Use it only with non-sensitive product images, confirm before uploading local files, and prefer self-service API-key setup through LinkFox rather than giving an agent phone numbers or SMS codes. Avoid setting custom LinkFox endpoint environment variables unless you fully trust the destination, and be aware that results and payment QR assets may be saved locally under a linkfox directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request URL and headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY and session-related headers, and the code sends the API key to whatever gateway is configured. In an agent or CI environment, a malicious parent process or workspace configuration could redirect requests to an attacker-controlled host and exfiltrate credentials and user-supplied image-search data.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token requests to those endpoints. In an agent/runtime environment where env vars may be influenced by deployment or a malicious wrapper, this enables exfiltration of credentials and session material to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request uses a URL derived from environment-controlled base configuration and attaches the LinkFox API key in the Authorization header before calling urlopen. If an attacker can influence the environment, they can redirect these requests to an attacker server and capture the API key and subsequent account/order metadata.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs use of environment variables, network access, and file writes but does not declare these capabilities or obtain explicit user-facing consent boundaries. Hidden or undeclared capabilities reduce transparency and can surprise users by causing filesystem writes, external requests, or credential handling in contexts where only a simple search skill is expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as an Amazon image-search utility, but the referenced onboarding and billing flows indicate it may also perform account login, API-key generation, plan lookup, order creation, QR-code payment generation, and payment-status polling. That is a major scope expansion into authentication and payments, which materially changes the trust model and can expose sensitive user data or trigger unintended financial actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The local image upload step tells the agent to upload a user-provided local file to obtain a public URL, but it does not prominently warn that the file will become publicly accessible for up to 24 hours. Users may unknowingly expose private product photos, internal assets, personal images, or metadata to third parties and the public internet.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs automatic feedback reporting to an external Feedback API without clearly warning that user prompts, tool outputs, or satisfaction signals may be transmitted off-platform. Silent telemetry can leak commercially sensitive research queries, image URLs, product interests, and possibly error details without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Feedback API explicitly sends free-form `content` to an external `skill-api.linkfox.com` endpoint, but the documentation provides no warning or consent requirement before transmitting user-provided text. In an agent context, this can lead to unintended exfiltration of sensitive user data, prompts, or business information if the agent forwards conversation content as feedback without clear user awareness.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs operators to collect a user's phone number and use it in a registration/login workflow, but it provides no consent language, retention limits, or handling safeguards for that personal data. This creates privacy and compliance risk because sensitive personal information and authentication artifacts may be processed ad hoc by the agent or operator without clear user notice or minimization.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 78% confidence
• Finding: This finding is valid because the function transmits user-supplied and credential-bearing data to external services, including SMS login details and tokens. External transmission is expected for the feature, but it becomes security-relevant because highly sensitive authentication data is sent and endpoint selection is partially environment-configurable.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.