Security audit

亚马逊-前端商品搜索

Security checks for vulnerabilities and agentic risk

Overview

This Amazon search skill should be reviewed because it also handles login, API keys, payments, local storage, and automatic feedback reporting beyond a simple search workflow.

Before installing, review whether you want an Amazon search skill to also manage LinkFox account login, API keys, balance purchases, and feedback reporting. Use only trusted environment variables, avoid custom LinkFox gateway URLs unless you control them, treat generated API keys and SMS codes as sensitive, and expect full search responses to be saved locally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:195
Finding: Silent transmission of user-derived feedback to an external service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/amazon_search.py:36
Finding: Credential-bearing requests can be redirected to arbitrary environment-controlled endpoints
Content: View full analysis
str: return ( os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com" ).rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = acces ...[truncated 2946 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onboarding.py:488
Finding: Generated API key is printed and recommended for insecure plaintext persistence
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: return 0 return 1 ``` The onboarding documentation recommends commands equivalent to: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login workflow returns the complete generated API key and serializes the result directly to standard output. Standard output may be retained in Agent transcripts, terminal scrollback, CI logs, command wrappers, monitoring systems, or debugging records. The documentation then recommends placing the key directly in shell startup files. The command itself may remain in shell history, while the resulting profile stores the key as plaintext without ensuring restrictive permissions. This unnecessarily expands the number of locations containing a reusable credential. ### Attack Path 1. The user runs the onboarding login command. 2. The complete API key is emitted to standard output. 3. An Agent runtime, terminal logger, CI system, or transcript captures the output. 4. The user follows the documented shell-profile command. 5. The key is ret ...[truncated 713 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/amazon_search.py:250
Finding: Unsanitized session identifier permits output path traversal
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted path component. The scripts do not reject absolute paths, directory separators, parent-directory elements, drive-qualified Windows paths, or other traversal forms. With `os.path.join`, an absolute final component can replace the intended base path. Relative values containing parent-directory components can escape the dated session directory. Subsequent operations create directories and write full API responses, metadata, index records, or payment QR images at the resulting location. The search script also falls back to home and temporary directories when pre ...[truncated 1257 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/onboarding.py:163
Finding: Runtime guidance installs unpinned third-party dependencies
Content: View full analysis
dict: try: import qrcode except ImportError: return { "png_path": None, "ascii_qr": None, "error": "Missing QR-code dependencies", } def _require_requests() -> None: if requests is None: raise RuntimeError("Missing HTTP client dependency") ``` ### Technical Analysis The emitted installation guidance does not specify package versions, hashes, an approved package index, or an isolated environment. Package resolution therefore selects mutable releases from the user's configured Python index. The package names observed in the project are legitimate and no direct typosquatting was identified. Nevertheless, installing unspecified latest versions increases exposure to compromised releases, dependency-chain changes, malicious index configuration, and incompatible future versions. ### Attack Path 1. The user runs an onboarding feature without the optional dependencies installed. 2. The script instructs the user to install packages with an unpinned `pip install` command. 3. The user's package index or mirror resolves a mutable package version and transitive dependency set. 4. A compromised index, package release, or dependency is downloaded and installed. 5. The installed code executes during installation or when imported by the onboarding script. ### Impact Assessment A malicious dependency executes with the privileges of the Python environment or user performing the inst ...[truncated 291 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The request includes multiple environment-derived headers, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration risk: in a compromised or attacker-influenced runtime, API keys and session metadata can be sent to an arbitrary host over the network. In a skill context that runs automatically and handles authenticated requests, this is more dangerous because the code forwards sensitive execution metadata without validating the endpoint.
Content: Scanner excerpt · scripts/amazon_search.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 92% confidence
Finding: The code builds request destinations from environment variables and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence the process environment, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials and account data; this is especially dangerous because the file explicitly handles authentication and token issuance flows.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 92% confidence
Finding: The gateway request path uses an environment-derived base URL and attaches the LinkFox API key in the Authorization header before calling urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect gateway traffic and capture API keys, account data, order details, and other responses; because this skill includes purchase and account-management actions, the exposure is more dangerous than in a simple data-only utility.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is Amazon SERP retrieval, but the skill reportedly also performs phone login, API key generation/retrieval, account and subscription inspection, payment order creation, QR code payment generation, and payment-status queries. That is a major capability expansion into authentication, account data, and financial operations, creating risk of unauthorized actions and user confusion about what the skill may do.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate the skill for loosely related Amazon research requests, increasing the chance of unnecessary external calls, data transmission, and paid operations. Overbroad activation is especially risky here because the skill can store results locally and may invoke adjacent onboarding or feedback flows.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
{"keyword": "office chair", "amazonDomain": "amazon.com", "deliveryZip": "10001"}

text
## Display Rules 1. **Present data clearly**: Show search results in well-structured tables with key fields: position, ASIN, title, price, rating, review count, brand 2. **Highlight sponsored products**: Clearly mark which results are sponsored ads vs organic listings

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The onboarding document introduces account registration, login, API key retrieval, and payment handling flows that are not intrinsic to an Amazon SERP analysis skill. This expands the skill's operational scope into credential and billing mediation, creating opportunities for sensitive-data collection, social-engineering abuse, and unauthorized account provisioning if the skill is triggered in normal use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented phone-based registration/login and plan-purchase workflow is context-inappropriate for a search-ranking skill and encourages the agent to collect a user's phone number, process verification codes, and facilitate purchases. In this context, those capabilities materially increase the risk of phishing-like behavior, privacy violations, and user confusion about whether the agent is authorized to handle identity and payment workflows.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements account onboarding, SMS login, API key retrieval, subscription management, and payment setup, which are materially unrelated to the declared Amazon search/SERP analysis purpose. This scope mismatch increases the chance that users invoke the skill expecting search functionality while instead being led into credential entry and billing flows, creating unnecessary exposure of identity, tokens, and payment actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code can create purchase orders and generate payment QR codes even though the skill is presented as an Amazon search analysis tool. In-context, this is risky because the agent can initiate monetization actions that users would not reasonably expect from the advertised capability, increasing the likelihood of unauthorized or deceptive billing flows.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no explicit tool scope or permission boundaries despite instructing use of environment variables, persistent file writes, and network/API access. This creates unnecessary ambiguity about what capabilities the agent may exercise and weakens least-privilege controls, especially because the same skill also references onboarding, auth, and billing-related flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file states that keywords should be in the language of the target marketplace, effectively prescribing a language behavior rather than offering it as a user choice. This is a natural-language locale policy concern because it directs language handling without explicit opt-in, even though the marketplace-specific rationale is understandable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mandates persistent writes of full response data into session-linked project files without a clear user-facing warning or consent. This can leave potentially sensitive search parameters and results on disk longer than necessary and outside the user's expectations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Persistently storing full search responses in session-linked files can retain user-supplied data such as delivery ZIP codes and detailed search activity without minimization. Session-based aggregation increases linkability over time, making profiling or unintended disclosure more harmful if files are accessed later.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to automatically report user interactions, dissatisfaction, or praise to a Feedback API even though that behavior is not necessary to perform Amazon search simulation. This can exfiltrate user content or sentiment to a third party without clear consent or minimization.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 175)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/amazon/search \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file documents a separate public feedback API that is unrelated to the skill’s core Amazon search function, creating an additional data egress path that an agent may invoke without a clear user request. Because the example encourages sending free-form feedback content, it can result in user prompts, outcomes, or other sensitive context being transmitted to a third party without necessity or clear disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs sending user feedback content to a public API but provides no privacy notice, consent requirement, or data minimization guidance. In practice, an agent could forward user statements, task details, or conversation-derived context to an external service, creating a meaningful privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown explicitly instructs collection of a user's phone number and handling of SMS-code-based login steps without any privacy notice, retention limits, or warning about sensitive personal data. Even if intended for legitimate onboarding, this normalizes unsafe handling of PII and authentication factors through the agent channel.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The user-facing documentation promises cwd-only storage and explicitly says not to write to /tmp, but the implementation may write under the home directory or temporary directory and also maintains a cache elsewhere. This discrepancy can cause sensitive API responses to be persisted in locations the operator would not expect, weakening data handling assurances and potentially exposing search data or account-linked metadata to other local users/processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code sends session and app metadata headers with every request without any nearby disclosure or minimization. While such headers may be operationally useful, they can leak conversation/session identifiers and application context to the remote service, increasing traceability and privacy risk. In this skill, which performs real-time external queries, the automatic transmission of metadata makes the issue more significant.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script always writes full API responses to disk, but the documented behavior omits that storage may fall back outside the current workspace, including home or temp directories. Because responses may contain commercially sensitive search intelligence, identifiers, or error details, undisclosed persistence broadens the exposure surface and can violate operator expectations or retention policies.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module description, help text, logs, and validation messages are entirely in Chinese, and the CLI also assumes a domestic phone format and +86 area code. This imposes a specific language/locale behavior without offering the user a choice or documenting it as a justified region-specific constraint.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Static analysis

No suspicious patterns detected.