亚马逊-前端商品搜索

• Outcome: Review
• Latest audit: Jul 13, 2026 · 12:09 PM UTC
• Version: 1.0.5

Overview

The skill’s Amazon search function is mostly coherent, but it also sends and stores more user/session data than its user-facing description clearly scopes.

Install only if you are comfortable sending Amazon search terms, marketplace settings, delivery ZIPs, API credentials, and session-related headers to LinkFox, spending LinkFox credits, and keeping raw search responses on disk. Use a dedicated workspace, avoid sensitive business queries unless needed, delete the generated linkfox files when done, and do not allow automatic feedback or onboarding downloads unless you explicitly want them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill invokes environment variables, network access, and persistent file writes but does not declare these capabilities up front. That creates a transparency and consent gap: users and hosts may believe this is a simple search skill while it can exfiltrate request/response data to remote services and store artifacts locally. In this context, the risk is elevated because the skill explicitly handles session-scoped data and writes full API responses to disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior materially differs from the advertised purpose: it claims real-time storefront simulation, but also caches results, persists full responses locally, and appears to be a wrapper around a remote API rather than a direct frontend simulation. This mismatch can mislead users into providing sensitive queries or relying on freshness guarantees that are not true, while silently expanding data retention and exposure beyond the stated task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation includes a separate feedback endpoint unrelated to the core Amazon search function, which broadens the skill’s externally reachable surface area. Because the endpoint accepts free-form content and is on a different base URL, an agent could be induced to transmit user prompts, operational details, or internal context to a third party without a clear necessity for fulfilling the user’s request.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script persistently stores full API responses, cache entries, and session metadata on local disk, even though the skill is described as a search/retrieval tool. Search responses can contain sensitive user queries, ranking research, account-linked metadata, or proprietary business intelligence, and this retention increases exposure beyond what is necessary to answer the user.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The module documentation promises not to write to /tmp and says failure should occur if the current directory is not writable, but the implementation silently falls back to the home directory and then the system temp directory. This breaks operator expectations and can cause data to be written into less controlled locations, increasing the risk of unauthorized local access, leakage across sessions, or accidental persistence in shared environments.

Vague Triggers

High

• Confidence: 84% confidence
• Finding: The trigger conditions are overly broad and instruct activation even when the user does not explicitly request search simulation, as long as the request is loosely related to Amazon search or SERP analysis. Overbroad auto-triggering increases the chance of unnecessary external calls, unexpected cost incurrence, and unintended disclosure of user queries to third-party services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs saving full API responses into the current project directory by default without a prominent privacy warning or user consent. Persisting complete responses can leak search terms, marketplace settings, delivery ZIP codes, session identifiers, and other task data into the workspace, where it may be retained, committed, or accessed by unrelated processes.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Requiring full API responses to be written under the active project directory creates a cross-context data exposure risk. Workspace storage is often broader than the immediate task boundary, so session-linked files and raw responses may be indexed, synced, shared, or accidentally committed, exposing user and session data beyond what is needed to answer the request.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.