亚马逊-店铺FBA

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:56 PM UTC
• Version: 1.0.1

Overview

This skill is not clearly malicious, but it should be reviewed because it can change Amazon FBA business data, handle LinkFox login/payment/API keys, and save full API responses without strong safety boundaries.

Install only if you trust LinkFox with your Amazon seller operations and LinkFox account billing flow. Before using it, verify all LINKFOX_* endpoint variables point to official LinkFox hosts, confirm every POST/PUT/DELETE or payment action with the user, and treat saved linkfox data files as sensitive business records.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code sends authentication material and other sensitive data to URLs whose base is taken from environment variables, with no allowlist or scheme/host validation. In a hostile or misconfigured runtime, an attacker can redirect login and token-generation traffic to attacker-controlled endpoints and capture SMS login tokens, access tokens, refresh tokens, and generated API keys.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway request target is derived from environment-controlled configuration and then used with the bearer API key in the Authorization header. If an attacker can influence the environment, they can exfiltrate the API key and any subsequent account/order data by redirecting requests to an attacker server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and instructs use of environment variables, shell execution, network access to a proxy endpoint, and file writes, but does not declare permissions or boundaries for those capabilities. This weakens governance and informed consent: an agent or reviewer cannot reliably assess what the skill may access or modify, increasing the chance of unintended data exposure or unsafe execution in a broader agent environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is FBA/SP-API proxying, but the detected behavior includes account onboarding, login, API key retrieval, plan purchasing, payment status checks, and QR-code payment generation. That is a significant scope expansion into authentication and billing flows, which creates risk of credential handling, financial transactions, and unexpected data collection outside the user’s likely expectations.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: emit_result serializes and writes full SP-API responses to local disk under predictable session directories. Those responses can contain seller, inventory, shipment, fulfillment, or operational data, so unnecessary persistence increases exposure through local compromise, over-retention, backups, or cross-session access.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This script exposes the `listItemComplianceDetails` SP-API operation even though the declared skill capability list does not mention item compliance details. That mismatch creates an undocumented capability surface that can bypass user, reviewer, or policy expectations about what the skill is allowed to do, increasing the risk of unauthorized access to compliance-related product data.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements SMS login, API key acquisition, plan listing, paid order creation, and payment QR generation, which is materially unrelated to the declared Amazon FBA/SP-API operational purpose. That mismatch is dangerous because it collects credentials and drives billing flows under the cover of an unrelated skill, increasing the likelihood of phishing, unauthorized account linkage, or hidden monetization.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code retrieves or generates LinkFox API tokens for a group using user login credentials, creating a credential-minting capability not justified by the FBA workflow. This can be abused to expand access beyond the immediate task, persist access after SMS login, and enable unauthorized use of platform APIs.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can create paid orders and render payment QR codes even though its manifest describes Amazon FBA/SP-API operations rather than LinkFox commerce flows. Embedding billing actions in an unrelated operational skill creates risk of deceptive charges, social engineering, and unauthorized purchases.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation explicitly exposes state-changing methods such as POST, PUT, DELETE, and PATCH plus write-operation fields like body/contentType, but does not pair them with a clear warning that these actions can create, modify, or remove Amazon FBA resources. In an agent skill context, this increases the risk that an autonomous agent or user triggers inventory, inbound-plan, shipment, or fulfillment changes without informed confirmation, leading to unintended business-impacting actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented delete capability (`deleteInventoryItem`) is presented as a normal operation without an explicit warning about destructive effects or any recommendation for confirmation before execution. In this FBA context, deleting inventory items or related records can disrupt listings, fulfillment workflows, and operational continuity, so the omission materially increases misuse risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This capability list advertises destructive inventory operations such as createInventoryItem, deleteInventoryItem, and addInventory without any warning that they mutate seller data or stock state. In an agentic context, documentation like this can cause an LLM or operator to invoke state-changing actions as if they were harmless lookups, leading to unintended inventory creation, deletion, or stock adjustments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The inbound capability section includes many operationally sensitive actions—cancellation, confirmation, scheduling, shipment updates, transportation selection, and compliance updates—without any indication of real-world consequences. In this FBA workflow context, these calls can alter inbound plans, appointments, shipment contents, addresses, and logistics decisions, so omission of warnings materially increases the chance of accidental execution by an autonomous agent or inattentive user.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The outbound section exposes fulfillment creation, return creation, order updates, cancellations, and status updates without warning that these can trigger customer-facing fulfillment and order lifecycle changes. Because this skill is specifically for Amazon FBA/MCF operations, misuse could create shipments, cancel active fulfillment orders, or alter order status in production, causing financial loss, customer harm, and operational disruption.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the operator to collect a user's phone number and submit it to a registration script, but it does not require clear consent language, a privacy notice, or data-handling limits. This creates a real privacy and compliance risk because personally identifiable information is being processed and transmitted without explicit safeguards or user disclosure in the workflow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper writes complete serialized results to disk without any indication of sensitivity controls, redaction, or user opt-in. In the context of Amazon FBA and fulfillment operations, full responses may include commercially sensitive or user-associated data, making local persistence a meaningful confidentiality risk.

Static analysis

No suspicious patterns detected.