亚马逊-以图搜图

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.7

Overview

The skill performs Amazon image search, but it also publicly uploads local images, handles account and payment setup, and can send feedback externally without clear user consent.

Install only if you trust LinkFox and are comfortable with these extra workflows. Use non-sensitive images, treat local uploads as publicly reachable, do not let the agent handle phone codes or payment orders unless you explicitly intend LinkFox account setup or recharge, avoid storing API keys in shell profiles, and disable or require confirmation for feedback reporting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:169

Finding

Automatic Transmission of Conversation Feedback Without Explicit User Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:65

Finding

Configurable Network Destinations Can Redirect Authentication Credentials

Content

View full analysis

str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Authentication tokens are attached to requests sent to those destinations: ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID if group_id: h["tid"] = group_id return h ``` The access and refresh tokens are sent to the configurable agent-user endpoint: ```python def _login_by_token(access_token: str, refresh_token: str) -> dict: resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) ``` The search and upload ...[truncated 2325 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/amazon_search_by_image.py:251

Finding

Unsanitized Session Identifier Allows Filesystem Path Escape

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script contains the same unsafe construction: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis The code does not reject absolute paths, path separators, `..` traversal components, or platform-specific drive prefixes. In Python, an absolute later component passed to `os.path.join` discards earlier components. Relative traversal components can also resolve outside the intended LinkFox directory. The search script subsequently writes `_meta.json`, index entries, cached responses, and complete API response files. The onboarding script writes generated payment QR images. The exact target filename is partly controlled by the application, but the destination dir ...[truncated 1022 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_image.py:91

Finding

Local Images Are Uploaded as Publicly Readable Objects Without Client-Enforced Expiration

Content

View full analysis

str: """Extract the base public URL by stripping query parameters.""" return presigned_url.split("?")[0] ``` ### Technical Analysis The client uploads the complete selected local image and explicitly assigns a `public-read` ACL. It then returns an unsigned object URL, meaning access does not depend on the temporary PUT signature. The documentation states that the URL is valid for 24 hours, but the client does not request deletion, verify a storage lifecycle policy, or enforce expiration. Server-side lifecycle controls may exist, but they are not established by the audited code. Therefore, the confidentiality ...[truncated 1223 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:480

Finding

API Key Is Printed in Full and Recommended for Plaintext Persistent Storage

Content

View full analysis

int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboarding guide recommends embedding the key literally in persistent shell configuration: ```text setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis Standard output is commonly captured by agent transcripts, terminal scrollback, CI logs, shell wrappers, and monitoring systems. Printing the full key therefore expands its exposure beyond the process that needs it. The recommended shell commands additionally place the key in command history and plaintext startup files. Startup files may be included in backups, support bundles, dotfile repositories, or readable home-directory snapshots. Exporting the key also causes every descendant process of the shell to inherit it, regardless of whether that process requires LinkFox access. ### Attack Path 1. A user completes SMS login through the onboarding script. 2. The script obtains or generates a LinkFox API key. 3. `_emit` prints the full key as JSON to stand ...[truncated 713 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:164

Finding

Runtime Installation Guidance Uses Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (34)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The request sent via urlopen includes multiple headers populated directly from environment variables, and the destination host is also overrideable through LINKFOX_TOOL_GATEWAY. In a hostile or multi-tenant runtime, an attacker who can influence environment variables can redirect requests and exfiltrate the API key and session metadata to an attacker-controlled endpoint, creating a real SSRF/credential-leak risk.

Content

Scanner excerpt · scripts/amazon_search_by_image.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 74)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 107)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to perform Amazon visual search, but also includes a local-image upload flow to LinkFox object storage that generates a public URL. That is a materially different data-handling behavior involving third-party storage and public exposure of user files, which users may not anticipate from the declared function alone.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to perform Amazon visual search, but also includes a local-image upload flow to LinkFox object storage that generates a public URL. That is a materially different data-handling behavior involving third-party storage and public exposure of user files, which users may not anticipate from the declared function alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs uploading local image files to obtain a publicly accessible URL valid for 24 hours, but does not provide a clear privacy warning about making user files publicly reachable. This creates a real risk of exposing sensitive images, metadata, or proprietary product information to unintended parties.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

https://example.com/competitor.jpg

text

## Display Rules

1. **Present data clearly**: Show search results in a well-structured table. Key columns to prioritize: product image, title, ASIN, price, rating, review count, and brand
2. **Image display**: When the response includes `imageUrl` for products, display them inline so users can visually compare results

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The onboarding content expands a simple Amazon image-search skill into account provisioning, API key acquisition, and paid billing workflows for a third-party service. This is dangerous because it can cause the agent to solicit credentials, drive registrations and purchases unrelated to the user’s requested task, and normalize privileged operational actions far outside the skill’s declared scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file instructs collecting a phone number, sending verification codes, logging in, listing plans, and creating payment orders, none of which are justified by an Amazon visual search skill. In context, this creates a high-risk capability for unnecessary PII collection and financial workflow initiation under the guise of a product-search feature.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring promises that writing to /tmp is forbidden and that failure to write to the current directory should error out, but the implementation silently falls back to the home directory and temp directory. This mismatch weakens operator expectations and can cause sensitive response data to be written into less controlled locations, including shared temporary storage, which materially increases exposure risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements phone-based onboarding, SMS verification, API-key issuance, package listing, order creation, and payment QR generation, which is materially unrelated to the declared Amazon image-search skill. This mismatch is dangerous because it can socially engineer users into disclosing phone numbers, SMS codes, and obtaining platform credentials under false pretenses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The billing and purchase functions create orders and render payment QR codes even though the skill is described as an image-search capability. In this context, hidden commerce flows are dangerous because they can induce unexpected charges and collect money through a capability users did not invoke or consent to.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code performs SMS login, token exchange, team enumeration, and API token retrieval/generation, none of which are necessary for image-based product search. In the declared skill context, this is highly suspicious because it solicits sensitive authentication factors and then issues reusable API credentials that could enable broader account access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill declares capabilities that involve environment access, file writes, and network interaction but does not explicitly scope or constrain those permissions. In a skill that handles user-supplied URLs, local files, uploads, and account-related flows, missing tool-scope declarations weakens least-privilege controls and makes unintended or abusive behavior harder to audit and contain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description is written primarily in Chinese and defines trigger behavior in Chinese, while the rest of the file is mixed-language. This creates a language/locale constraint in the skill's activation and behavior without explicitly offering the user a language choice or stating that the skill is region-specific.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires writing full tool responses to persistent session-scoped files in the project directory. Because responses may include user-supplied URLs, marketplace preferences, account-related errors, and potentially enriched commercial data, persistent logging increases the chance of later exposure through repo contents, workspace sharing, or subsequent agent access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says feedback should be auto-detected and reported via an API without disclosing to the user that portions of their interaction may be transmitted externally. Silent telemetry of user intent, dissatisfaction, or praise can leak behavioral data and violates transparency expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 123)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/amazon/searchByImage \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file introduces a separate public feedback-submission API that is unrelated to the core image-search function. In an agent skill context, this expands the skill’s action surface and could cause the agent to transmit user content to an external service without a clear user-triggered need, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The feedback API section instructs sending free-form content to an external endpoint but does not warn that user-provided text may contain sensitive data. In an agent setting, this omission can lead to unreviewed exfiltration of personal, confidential, or proprietary information under the guise of feedback submission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown tells the operator to ask for a user phone number and use it to send/login with verification codes, but provides no privacy notice, consent language, retention limits, or safer alternative path beyond ad hoc collection. That creates unnecessary exposure of personal data and increases the chance of mishandling sensitive identifiers and one-time codes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline comment for SMALL_THRESHOLD says small responses are 'directly output, not written to file'. In main(), the script serializes the result and writes it to out_path unconditionally before deciding whether to print the full JSON or a summary, so the comment contradicts actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.