亚马逊-店铺目录

• Outcome: Review
• Latest audit: Jul 13, 2026 · 12:09 PM UTC
• Version: 1.0.5

Overview

The skill appears to be a legitimate Amazon catalog lookup tool, but it automatically stores full authenticated API responses locally with weak scoping and partly inaccurate disclosure.

Review this before installing if Amazon seller catalog data, SKUs, query terms, or returned metadata are sensitive. Use it only in a workspace where local LinkFox logs are acceptable, avoid --inline for sensitive results, verify the LinkFox gateway/auth setup before providing an API key, and periodically delete the generated linkfox data files if they are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation instructs use of environment variables, local file writes, network calls, and shell-based Python script execution, but it does not declare permissions or boundaries for those capabilities. This creates an authorization and transparency gap: a host agent may invoke sensitive operations without an explicit least-privilege contract, making misuse or unintended data exposure more likely.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper persistently saves full API responses to local session files under predictable directories, even though catalog operations are described as read/query oriented. Catalog and store API responses may contain business-sensitive metadata, and silent persistence expands data exposure to local users, other processes, backups, or later unintended reuse.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger description is broad and can activate on many generic Amazon catalog-related phrases, increasing the chance the skill is invoked in contexts the user did not intend. Over-broad activation can lead to unnecessary API calls, data handling, or local persistence of results, especially since the skill also performs network access and writes full responses to disk.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: API responses are written to disk without any user-facing disclosure, consent, or warning. Even if the API is query-oriented, silent local storage of returned data creates a confidentiality and privacy risk because users may reasonably expect transient handling rather than persistent logging.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to always persist full API responses in session-organized local logs, which can retain product metadata, identifiers, seller information, user-supplied query terms, and possibly error payloads longer than needed for the task. Mandatory retention expands the exposure window for sensitive or proprietary data and can leak information across sessions, workspaces, backups, or other tools with filesystem access.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The result-emission helper both saves full API responses to disk and may print them inline, which can leak sensitive store or catalog data into console output, logs, transcripts, or local artifacts. In a skill that brokers authenticated SP-API access, this behavior is more dangerous because responses may include business data beyond what the user intended to expose persistently.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.