亚马逊-店铺External Fulfillment

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.1

Overview

The skill appears to support the advertised Amazon External Fulfillment workflow, but it also bundles sensitive LinkFox account onboarding, API-key issuance, and payment-order flows that should be reviewed before installation.

Install only if you trust LinkFox with Amazon fulfillment data, phone-based account onboarding, reusable API keys, and billing actions. Before use, keep endpoint environment variables pointed at trusted LinkFox HTTPS hosts, avoid sharing SMS codes unless you intend to create or access that account, treat stdout and saved response files as sensitive, and require explicit confirmation before any inventory, shipment, package, invoice, label, or payment-order action.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The script builds destination URLs from environment-controlled base URLs and then sends authentication material, login tokens, SMS-login data, and API-token management requests to those endpoints. In an agent/skill environment, untrusted or misconfigured environment variables can redirect these requests to attacker-controlled infrastructure, causing credential exfiltration or SSRF-like outbound access.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request path uses an environment-derived base URL and attaches the LinkFox API key in the Authorization header before calling urlopen. If the environment is attacker-influenced, the script can be coerced into transmitting API credentials and account/order data to an arbitrary external server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes concrete capabilities to read environment variables, write response files to disk, invoke shell commands, and make outbound network requests, yet it does not declare permissions or user-visible boundaries for those operations. This weakens least-privilege controls and informed consent, making it easier for a skill to access secrets, persist sensitive Amazon fulfillment data locally, or execute helper scripts without explicit governance.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is limited to Amazon External Fulfillment API access, but the detected behavior includes SMS-based LinkFox login, API key generation, package purchase, recharge order creation, payment-status polling, and QR code generation. That is a major scope expansion into account access and payment workflows, which can surprise users and create unauthorized billing, credential handling, and sensitive data exposure risks.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The file introduces authentication recovery, registration, and billing/payment workflows that are outside the stated purpose of an External Fulfillment SP-API skill. This scope expansion increases the skill’s privilege and data-handling surface, creating opportunities for credential collection, payment redirection, and social-engineering abuse if the onboarding path is triggered unexpectedly or modified.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill is declared as an Amazon External Fulfillment integration, but the file implements unrelated LinkFox account onboarding, SMS login, API-key issuance, subscription/package browsing, and commerce flows. Such capability drift is dangerous because users or host systems may grant trust and secrets for one purpose while the code performs materially different privileged actions.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code can create purchase orders, render payment QR codes, and query payment state, which is unrelated to the stated External Fulfillment SP-API purpose. In context, hidden commerce functionality increases the risk of unauthorized purchases, user deception, and abuse of trusted execution environments.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file performs SMS authentication, account session establishment, team discovery, and API-token retrieval/generation, all outside the declared External Fulfillment operational scope. This broadens the trust boundary and exposes users to credential handling and secret issuance behavior they would not reasonably expect from a fulfillment API skill.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This skill supports write operations that can confirm or reject shipments, create or modify packages, update package status, write inventory, and generate invoices or labels, but the description lacks an explicit warning that these actions change fulfillment state or create business artifacts. In a commerce context, silent execution of such operations can cause inventory corruption, shipment workflow changes, carrier artifacts, and downstream financial or operational issues.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions explicitly tell the operator to collect a user's phone number and use it with a script to send a code and log in, but provide no privacy notice, consent language, retention limits, or verification that the number belongs to the requester. That creates a real risk of unauthorized account access, mishandling of personal data, and account takeover through an agent-mediated flow.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The login command emits the freshly obtained API key directly to stdout JSON. In agent platforms, stdout is commonly logged, persisted, surfaced to other components, or included in transcripts, so this can leak a reusable secret beyond the intended recipient.

Static analysis

No suspicious patterns detected.