亚马逊-店铺授权

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.7

Overview

This skill mostly matches Amazon store authorization, but it also handles sensitive tokens, LinkFox account login, API key issuance, payment flows, automatic feedback reporting, and local response storage in ways users should review carefully.

Review before installing. Use it only in a trusted workspace, confirm the LinkFox endpoints and environment variables are controlled, avoid exposing Amazon access or refresh tokens in chat/logs/files, and treat the onboarding/payment commands as separate sensitive actions that require explicit user intent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request target is derived from environment-controlled configuration via API_BASE_URL, then used directly in urlopen with the Authorization API key attached. If an attacker can influence LINKFOX_TOOL_GATEWAY/STORE_API_BASE_URL/SPAPI_BASE_URL, they can redirect the request to an attacker-controlled host and capture the API key and request data. In an agent/skill context, environment values are often deployment-controlled, so this creates a realistic secret exfiltration and SSRF-style risk.

Tainted flow: 'req' from os.environ.get (line 46, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request destination is built from environment-controlled base URL values and then used directly in urlopen while attaching the Authorization API key header. If an attacker can influence LINKFOX_TOOL_GATEWAY, STORE_API_BASE_URL, or SPAPI_BASE_URL, they can redirect the request to an arbitrary server and capture the API key, making this an SSRF-plus-secret-exfiltration issue.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code allows base URLs for login and agent-user requests to be overridden from environment variables, then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs via requests.post. In a skill execution environment where env can be influenced by a host, wrapper, or attacker, this becomes an exfiltration channel for credentials and account data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway URL is derived from environment variables and used in urllib.request.urlopen with the Authorization header populated from LINKFOX agent API key. If an attacker can influence the environment, the skill will send the bearer credential and business requests to an attacker-controlled server.

Tainted flow: 'req' from os.environ.get (line 48, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request destination is derived from environment-controlled base URL values and then used in urlopen with an Authorization header containing the API key. If an attacker can influence LINKFOX_TOOL_GATEWAY, STORE_API_BASE_URL, or SPAPI_BASE_URL, the script will send credentials to an arbitrary host, enabling SSRF-style exfiltration of the API key and request data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents capabilities to access environment variables, write files, and make network requests, but does not declare permissions or present clear scope controls. Undeclared powerful capabilities increase the risk of hidden data handling, unexpected persistence, and network exfiltration beyond what users or reviewers would reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The static finding indicates the skill behavior extends well beyond Amazon store authorization into phone-code login, API key generation, account inspection, plan purchasing, payment QR generation, and payment status checks. That is a major scope expansion into authentication, billing, and account management, which materially increases the attack surface and could trick users into unintended account or financial operations.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The instruction to automatically submit feedback for user satisfaction, praise, dissatisfaction, or any perceived improvement point expands processing beyond the stated authorization/token-management purpose. This can cause unprompted transmission of user interaction metadata or content to another API, creating privacy and data-governance risk unrelated to the core task.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatically sending feedback about satisfaction or general improvement points is not necessary to authorize stores or manage token lifecycles. Unnecessary secondary data flows are dangerous because they normalize hidden reporting and may leak user preferences, complaints, or contextual task details to external systems without a clear need-to-know basis.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documented `/spApi/storeTokens` and `/spApi/refreshToken` flows return raw Amazon `accessToken` and `refreshToken` values to the client, turning the skill into a credential-retrieval mechanism rather than a bounded authorization manager. Any client, plugin, log sink, or downstream agent with access to these responses can reuse the tokens to act on the seller account, and refresh tokens in particular can enable long-lived account access.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The document explicitly claims tokens are 'not exposed to the frontend,' but earlier API definitions return both access and refresh tokens directly to callers. This contradiction is dangerous because it can mislead reviewers and integrators into treating a credential-exposure design as safe, increasing the chance the sensitive outputs are broadly consumed, logged, or cached.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file introduces account onboarding, SMS registration, API key acquisition, and billing purchase flows that are outside the stated purpose of an Amazon store authorization/management skill. This expands the skill's operational scope into sensitive identity, credential, and payment handling, increasing the chance of unauthorized data collection, user confusion, and abuse through hidden secondary workflows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented workflow enables user registration, SMS login, and payment plan ordering despite the skill being presented as an Amazon seller authorization tool. Such unjustified capability creep is dangerous because it can be used to funnel users into unrelated platform accounts and purchases, exposing personal data and enabling social-engineering style misuse under the guise of Amazon store management.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The guide includes a refresh token in example API responses even though refresh tokens are long-lived credentials that can enable persistent unauthorized access if copied into logs, screenshots, chat tools, or test clients. In documentation for an authorization skill, normalized exposure of real token-bearing response shapes materially increases the chance that developers will surface or handle these secrets insecurely.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document tells users to retrieve raw access tokens and directly use them in subsequent requests, while later stating tokens should not be passed to the frontend. In practice, a quick-start like this encourages manual token handling and increases the risk that integrators will expose bearer tokens in browser code, scripts, logs, or operator workflows.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The helper serializes and persists full API responses plus session metadata to local disk under a predictable directory structure. In the context of Amazon store authorization and token/status management, those responses can plausibly contain access tokens, refresh tokens, seller identifiers, account details, or authorization status data, creating a sensitive-data-at-rest exposure beyond the skill’s stated need.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements LinkFox account onboarding, SMS login, API key retrieval, subscription browsing, and payment flows, which are unrelated to the declared Amazon store authorization purpose of the skill. This mismatch is dangerous because users or orchestrators may invoke the skill expecting Amazon seller authorization while it instead collects identity factors and provisions unrelated platform credentials.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The order creation, package listing, and payment QR generation logic introduces a commercial purchase workflow that is outside the stated Amazon store authorization scope. In a mismatched skill, this can trick users into initiating payments or account actions they did not intend when seeking seller-account authorization help.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill logs a user in by SMS and then generates or retrieves a LinkFox API key, returning it in stdout JSON. This is a powerful credential-management capability unrelated to Amazon store authorization, and in an agent setting stdout is often captured by hosts, logs, or downstream tools, enabling credential theft and account takeover.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger conditions are broad enough to activate on many general Amazon seller workflows, not just authorization tasks. Over-broad activation increases the chance that the skill will handle contexts it was not meant to handle, potentially causing unnecessary account queries, token operations, or collection of store-selection data when another skill should have been used.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs that complete API responses are always written to local disk, and those responses may include authorization metadata and, in legacy cases, tokens. Mandatory persistence without a clear user-facing warning or minimization policy creates a strong risk of sensitive data exposure through local files, backups, logs, shared workspaces, or later unintended reuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly defines APIs that return live accessToken and refreshToken values, including full example response fields, while providing only a brief note about masking tokens later. In an agent skill context, this increases the chance an agent will retrieve, store, relay, or display raw credentials to users or downstream tools, leading to account takeover or unauthorized Amazon SP-API access.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation normalizes returning raw access and refresh tokens without clearly warning that these are high-sensitivity credentials. In an agent skill context, such omissions materially increase the likelihood that developers will surface, store, or forward tokens in unsafe ways, enabling unauthorized Amazon seller account access if intercepted.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The example callback URL includes `access_token` and `refresh_token` in the URL/query string, which are commonly captured by reverse proxies, browser history, referrer headers, monitoring systems, and server logs. Even if the callback is internal, documenting and apparently accepting this pattern creates a serious leakage channel for long-lived credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the operator to collect a user's phone number and pass it to a script that sends codes and performs login, but they provide no privacy notice, retention policy, or warning that the data is being transmitted to an external service. In the context of an Amazon authorization skill, this is especially risky because users would not reasonably expect phone-based registration for a separate platform, making over-collection and privacy harm more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.