亚马逊-店铺数据上传

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.7

Overview

The skill mostly matches its Amazon Feeds purpose, but it also handles credentials, payments, direct file uploads, feed cancellation, and persistent response storage with controls users should review first.

Review this skill before installing if you will use it with real seller accounts. Use only trusted LinkFox endpoint environment variables, avoid passing arbitrary local files or upload URLs, treat generated API keys and payment QR data as secrets, and confirm any feed cancellation with the user before running the script.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The POST target is derived from environment-controlled base URLs via _login_base/_agent_user_base, and the request can carry highly sensitive data including SMS login credentials, access tokens, refresh tokens, UID headers, and group identifiers. If an attacker can influence environment variables in the runtime, the CLI will exfiltrate those secrets to an attacker-controlled endpoint, making this an SSRF/exfiltration risk rather than a harmless configuration pattern.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is built from environment-controlled LINKFOX_AGENT_API_URL/LINKFOX_TOOL_GATEWAY and then used in urlopen with the API key attached in the Authorization header. A hostile environment can redirect requests to attacker infrastructure and capture the API key or trigger internal network access, so this is a real external transmission vulnerability.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises and instructs use of environment variables, shell execution, filesystem writes, and outbound network access, but does not declare any permissions or capability boundaries. This creates a transparency and governance gap: operators and users cannot accurately assess what the skill can access, and an over-privileged or hidden-capability skill is harder to safely review and sandbox.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: A description-behavior mismatch is high risk because the skill claims to handle Amazon Feeds operations, but static analysis indicates additional account-login, API-key management, plan purchase, payment QR generation, and order-status behaviors. Hidden or undeclared billing/authentication flows materially expand the attack surface and could mislead users into authorizing sensitive actions they did not intend.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: `emit_result()` serializes and writes full API responses to local files under predictable session directories. In the Feeds/SP-API context, responses can contain seller identifiers, feed document metadata, presigned URLs, processing reports, or other sensitive business data, so undisclosed persistence materially increases the risk of local data exposure and retention beyond user expectations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox onboarding, SMS login, API key issuance, package listing, ordering, and payment QR generation, which is materially unrelated to the declared Amazon SP-API Feeds functionality. Such scope divergence is dangerous because users invoking a Feeds skill would not reasonably expect account bootstrap and commerce actions, increasing the chance of unauthorized credential collection and unintended purchases.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes even though the skill is supposed to handle Amazon Feeds operations. Commerce capabilities expand the blast radius from data/API actions to real financial transactions, and in a mismatched skill context they are especially risky because a user may be induced into payments unrelated to the requested task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file performs SMS authentication, account login, user/team discovery, and API token generation, all outside the stated scope of an Amazon Feeds integration. In context, this broadens the skill into a credential-handling onboarding agent, creating unnecessary exposure of personal data and secret issuance in a place users would not expect.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation exposes a workflow where user-provided file content, raw string content, or base64-decoded content is uploaded directly to a presigned `uploadUrl` returned by Amazon, but it does not clearly warn that this transmits data to an external destination outside the developerProxy path. In an agent setting, this can lead to unintended exfiltration of local files or sensitive content if a user or downstream prompt supplies `filePath` or content without understanding that it will be sent off-platform to a third-party URL.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding flow explicitly instructs collecting a user's phone number and using it to register/login via a script, but it does not require an explicit privacy notice, consent language, retention limits, or guidance on secure handling of that personal data. In a support/onboarding context this increases the risk of unnecessary collection, improper disclosure, or mishandling of personally identifiable information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper writes API responses to disk and only prints a 'Saved full response' message after the fact, without prior disclosure or consent. In a skill handling Amazon seller feed operations, silent persistence can expose sensitive operational data to other local users, backups, or later processes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs a destructive SP-API cancelFeed operation immediately after parameter validation, with no user-facing confirmation, dry-run mode, or secondary guardrail. In an agent/tooling context, this increases the risk of accidental or unauthorized cancellation of in-flight feeds due to mistaken prompts, parameter confusion, or unsafe orchestration, causing operational disruption to inventory or listing updates.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI is designed to emit API keys, payment URLs, QR content, and related artifacts to stdout JSON. In agent and automation environments, stdout is commonly logged, persisted, or shown to other tools, so this can leak secrets and payment data beyond the intended recipient.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.