亚马逊-店铺A+页面

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.7

Overview

This skill is mainly an Amazon A+ Content tool, but it also handles LinkFox login, API key generation, payments, and persistent response storage with weak safeguards.

Review this skill before installing if you are not comfortable letting an agent handle LinkFox account login, SMS verification, API key creation, subscription ordering, payment QR generation, and local storage of Amazon A+ response data. Use only trusted LinkFox endpoint environment variables, avoid sharing verification codes unless you initiated the flow, and treat stdout/logs from onboarding as secret-bearing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, and this function sends sensitive login material such as phone numbers, SMS codes, access tokens, and refresh tokens to those endpoints. If an attacker can influence environment variables, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials and session tokens.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request target is built from environment-controlled base URLs and includes the Authorization header populated from LINKFOX API keys. An attacker who can set the environment can redirect requests and harvest API keys or manipulate order/account actions via a malicious endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities that use environment variables, shell execution, network access, and file writes, but it does not declare permissions or scope these capabilities. Undeclared powerful capabilities reduce transparency and prevent proper policy enforcement, increasing the risk of unintended data exposure, filesystem modification, or external requests beyond user expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to manage Amazon A+ Content, but the observed behavior includes LinkFox account login, SMS verification, API key generation, account info retrieval, and payment/order flows that are unrelated to the declared purpose. This description-behavior mismatch is dangerous because it can mislead users into exposing credentials or authorizing billing/account actions they did not intend.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The onboarding document expands the skill's scope from Amazon A+ Content management into account registration, login, API key acquisition, and payment handling. That creates an unnecessary privilege and data-handling surface, increasing the chance an agent will collect sensitive information or perform security-relevant actions unrelated to the advertised skill purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper writes full API responses to local disk by default, including potentially sensitive Amazon store data, publish records, identifiers, and any unexpected data returned by the proxy. Because the skill description centers on A+ Content API operations and does not disclose local persistence, this creates an undisclosed data-at-rest exposure and broadens the blast radius if the host is shared or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This code builds a generalized session archive under multiple candidate filesystem locations and records metadata plus data files across runs, which exceeds the narrowly described A+ management purpose. Such generalized archival behavior increases the chance of long-term accumulation of sensitive operational data and creates a reusable local data store that other processes or users may access.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements an onboarding, login, token issuance, plan listing, and payment CLI, which is materially unrelated to the declared Amazon A+ Content management purpose. Such scope expansion increases the attack surface and introduces credential-handling and commerce capabilities users would not expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can list subscription packages, create orders, generate payment QR codes, and query payment status, none of which are justified by an A+ Content management skill. This broadens the blast radius from content management into financial transactions and creates risk of unauthorized purchases or social-engineered payment collection.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill can retrieve or generate LinkFox API tokens after SMS login, giving it account provisioning power beyond the stated A+ Content scope. This is dangerous because it creates fresh credentials that may be reused outside the intended workflow and enables privilege expansion if abused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that posting ASIN relations performs a full replacement and may suspend content on removed ASINs, but it does not elevate this behavior into a clear warning, confirmation, or safe-operating procedure. In an agent skill context, this increases the chance that an automated workflow or unsuspecting user will trigger unintended large-scale content suspension across product detail pages.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell the agent to solicit phone numbers and process login/verification-code flows without any privacy notice, consent language, retention guidance, or minimization constraints. In an agent setting, this can normalize collection of personal data and authentication factors in chat, which raises account takeover and privacy risks if mishandled or spoofed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Full response data is persisted locally without clear runtime warning or consent, which can expose sensitive business data to other local users, backup systems, or malware on the host. The danger is heightened because the function is a shared helper likely reused by multiple entrypoints, making persistence the default behavior rather than an exceptional debug action.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The login flow returns the API key directly in stdout JSON, which may be captured by logs, orchestration layers, shell history, transcripts, or other tools handling command output. Exposing credentials this way increases the likelihood of accidental disclosure and subsequent account compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script performs a state-changing external API call that submits A+ content for approval/publication, but it provides no explicit user-facing confirmation, dry-run mode, or safety warning before triggering that action. In an agent/tooling context, this increases the risk of unintended publication workflow changes from ambiguous prompts, mistaken automation, or prompt-injection-driven tool use.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script performs a full replacement of all ASIN relations for an A+ content document by sending the provided asinSet directly to postContentDocumentAsinRelations, which can remove existing ASIN associations and suspend display on removed ASINs. Because the operation is destructive and the script provides no explicit runtime confirmation, dry-run, or strong user-facing warning beyond comments/docstring, a mistaken or malicious invocation can cause unintended catalog impact across listings.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This code transmits sensitive data externally, including login information and tokens, which is expected behavior for an onboarding client but still security-relevant. In the context of a skill whose declared purpose is Amazon A+ Content management, this external credential transmission is more dangerous because it is out of scope and harder for users to anticipate.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.