亚马逊-店铺买家反馈

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 1.0.7

Overview

The skill performs the advertised Amazon feedback lookups, but also embeds sensitive account onboarding, API-key generation, payment ordering, and default local storage that require review.

Review before installing. Use this skill only if you accept LinkFox-mediated Amazon feedback calls, local plaintext storage of full API responses, and the embedded LinkFox account/billing workflow. Prefer creating or retrieving API keys directly from the provider site, avoid sharing SMS codes through an agent unless necessary, verify no LINKFOX_* base URL overrides point to untrusted hosts, and remove saved linkfox response files when they are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, so a modified runtime environment can redirect SMS login, token exchange, and API-key generation traffic to an attacker-controlled host. Because these requests carry sensitive data such as phone numbers, verification codes, access tokens, refresh tokens, and generated API keys, this becomes credential exfiltration rather than a harmless configuration feature.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway request target is also environment-derived, allowing an attacker controlling environment variables to reroute authenticated API calls to an arbitrary server. These calls include the bearer API key in the Authorization header and can expose account information, package metadata, and order/payment operations to an unintended recipient.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation describes capabilities that access environment variables, invoke shell scripts, perform network calls, and write files, yet it declares no permissions. This creates a trust and governance gap: users and host platforms cannot accurately assess what the skill can access, increasing the chance of unintended data exposure or unsafe execution in permissive environments.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill says requests consume credits and warns not to automatically retry because of extra cost, but later states '不消耗积分' ('does not consume points'). Contradictory billing and cost semantics can mislead operators into making repeated calls or bypassing consent flows, causing unexpected charges or unsafe automation behavior around paid APIs.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The onboarding document introduces authentication recovery, SMS registration, API key setup, and billing/payment workflows that are outside the declared purpose of an Amazon Customer Feedback analytics skill. This scope expansion is dangerous because it enables the skill operator to solicit credentials, phone numbers, and payment actions through the agent path, increasing phishing, account-abuse, and unauthorized service-enablement risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documented capability explicitly supports SMS login, account registration, plan listing, order creation, and payment handling, none of which are justified by a customer-feedback insight skill. In context, this materially increases the blast radius from a read-oriented analytics skill to one that can drive account creation and monetization flows, creating opportunities for social engineering, privacy misuse, and unauthorized charges.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper persists full API responses and session metadata to local disk by default, even though the skill is described as an insight retrieval tool rather than a logging/archive component. Customer feedback and seller-scoped API data may contain business-sensitive information, and writing it in plaintext expands retention, access, and exfiltration risk beyond the immediate task.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key retrieval, subscription listing, order creation, and payment QR generation, which is materially unrelated to the declared Amazon Customer Feedback analytics purpose. That mismatch is dangerous because it creates a concealed credential acquisition and monetization path inside a skill users would invoke for analytics, increasing the chance of deceptive collection of phone numbers, OTPs, and account tokens.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Purchasing and payment QR generation are unjustified for a customer-feedback insight skill and introduce direct financial-action capability. In this context, the code could steer users into unintended purchases or present payment artifacts under the guise of analytics setup, making the context substantially more dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code performs SMS-based login, token exchange, team selection, and API-key generation, all unrelated to Amazon customer-feedback retrieval. In the stated skill context this is a covert credential onboarding workflow, which is especially dangerous because it can harvest user phone numbers, one-time codes, and produce reusable API credentials.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that complete API responses are always written to a local project directory under a session-based path, without requiring explicit user acknowledgement. Customer feedback and related marketplace data may be sensitive or proprietary, and persistent local storage increases the risk of accidental retention, leakage through source trees, backups, logs, or later tool access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the operator to ask for and use a user's phone number to register/login via script, but provide no privacy notice, retention policy, consent language, or safeguards for handling that personal data. This is risky because phone numbers and SMS codes are sensitive authentication data, and collecting them through an agent workflow can facilitate credential interception or improper data processing.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: API responses are written to disk automatically without explicit user confirmation or a clear warning, which can surprise users and violate least-astonishment and data-minimization expectations. In this skill context, the stored content may include seller/business analytics and proxied API output that users may expect to remain ephemeral.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The function retrieves or generates an API token and returns it to the caller without any in-file warning, masking, consent gate, or indication of the sensitivity of the returned secret. In combination with the misleading skill purpose, this increases the risk that highly privileged credentials are exposed to users, logs, downstream tooling, or prompt transcripts without understanding the consequences.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Session logging stores full API responses and metadata in plain JSON under predictable local directories, potentially retaining seller-provided identifiers and response content longer than needed. If the host is shared, backed up, or otherwise accessible to other processes or users, this increases the chance of unintended disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 86% confidence
• Finding: This network transmission is security-relevant because the request may carry authentication material and personal data to a host chosen via environment overrides. In isolation external transmission is normal, but in this file it is dangerous due to the sensitive payloads and lack of strict endpoint validation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.