亚马逊-前端商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:38 PM UTC
• Version: 1.0.7

Overview

The Amazon search function is coherent, but the skill also handles phone login, API-key issuance, paid order creation, automatic feedback reporting, and persistent local storage in ways users should review carefully.

Install only if you are comfortable with LinkFox receiving search terms, optional ZIP/location parameters, phone-login data during onboarding, feedback text, and API-authenticated billing requests. Avoid using endpoint override environment variables unless you control the destination, treat printed API keys as secrets, and review or delete the local linkfox output/cache directories if search results may contain sensitive business data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, access tokens, and generated API-token requests, to those endpoints. In a skill/onboarding context, environment variables are part of the trust boundary; if an attacker can influence them, the script can be redirected to exfiltrate credentials and session data to an attacker-controlled service.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The gateway helper uses an environment-derived base URL and attaches the API key in the Authorization header before issuing network requests. If the environment is tampered with, all authenticated gateway traffic, including account, package, and order operations, can be redirected to an attacker-controlled server, leaking credentials and enabling unauthorized actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions while its instructions explicitly require access to environment variables, file writes, and network/API calls. This creates a transparency and consent gap: an operator may invoke the skill believing it is low-risk, while it can read secrets, write artifacts into the workspace, and make external requests. The skill context increases risk because it also instructs persistent storage of API responses in the current project directory, which may contain sensitive business data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is Amazon search simulation, but the behavior reportedly extends into phone-based login, API-key acquisition, plan lookup, order creation, payment-status polling, and QR-code generation for purchases. That is a major scope expansion into authentication and billing flows, which can surprise users, trigger unintended purchases, and collect sensitive account data unrelated to the stated search function. In this context, the mismatch is especially dangerous because the skill already frames costs as normal operational behavior, making hidden monetization/account actions easier to slip in.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill persistently stores full API responses, session metadata, and indexes on disk even though the skill description is search-focused and does not clearly disclose durable local retention. Search responses can contain sensitive business data, queries, or identifiers, and the extra metadata creates a broader audit trail than users may expect.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation promises not to write to /tmp and says the script should fail if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This mismatch can cause sensitive response data to be written to locations with weaker isolation or outside the user’s expected workspace, increasing exposure and reducing operator control.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements an onboarding, login, API-key provisioning, subscription, and payment workflow that is unrelated to the declared Amazon search/SERP analysis purpose of the skill. That mismatch increases risk because the skill acquires credentials and enables billing actions beyond what a user would reasonably expect from a search-analysis capability.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can list paid plans, create orders, and generate payment QR codes, introducing commerce capabilities that are not justified by the skill metadata describing Amazon search-result analysis. In a mismatched skill, such billing functionality can surprise users, increase fraud/abuse potential, and expand the blast radius if the skill is invoked unintentionally or maliciously.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill performs SMS-based login and API-key provisioning even though its stated purpose is Amazon search/SERP retrieval. This over-privileged behavior expands collection of personal data and secrets, and in context is more dangerous because users invoking a search skill would not expect account-authentication flows that mint reusable API credentials.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger text instructs activation even when the user does not explicitly request search simulation, as long as the request loosely relates to Amazon search results or SERP analysis. Overbroad auto-triggering can cause the skill to run unexpectedly, leading to external API calls, credit consumption, and data collection without sufficiently informed user intent. The danger is amplified here because each invocation has monetary cost and produces persistent output files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API documentation instructs the skill to send user search terms and potentially location-related data such as delivery ZIP codes to an external endpoint, but it does not require any user notice, consent, or data-minimization guidance. Because the skill is explicitly triggered by user requests and may forward user-supplied queries and location context off-platform, this creates a real privacy and transparency risk even if the endpoint is legitimate.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The feedback API sends free-form content to a separate external service, yet the documentation does not warn that user-provided text may be transmitted outside the primary tool endpoint. This is dangerous because feedback content can easily contain personal data, sensitive context, or conversation details, and users may not expect that information to be sent to a different backend.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The onboarding flow explicitly tells the operator to ask for and submit a user's phone number to a registration script, but it provides no privacy notice, consent language, retention limits, or handling safeguards. Collecting personal contact data in this way creates unnecessary privacy and compliance risk, especially because the skill is designed to pass the number into a local script that may interact with an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The login command emits the generated API key directly to stdout JSON. In agent and CLI environments, stdout is commonly captured by logs, transcripts, parent processes, or chat surfaces, so this can expose a reusable credential to unintended parties and enable account compromise or unauthorized API use.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 83% confidence
• Finding: This is an external transmission sink used for login and token-related HTTP POSTs. External transmission alone is expected for networked functionality, but here it becomes dangerous because the destination is configurable and the payloads can include sensitive authentication data.

Static analysis

No suspicious patterns detected.