亚马逊-店铺Fulfillment Inbound

• Outcome: Review
• Latest audit: Aug 18, 2026 · 12:05 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Amazon FBA purpose, but it needs Review because it handles API keys, login tokens, billing flows, and full business responses with weak endpoint scoping and broad local persistence.

Install only if you trust LinkFox with your Amazon store operations and account billing flow. Use the default LinkFox endpoints, avoid setting LINKFOX_TOOL_GATEWAY or related endpoint override variables unless you fully control the target, treat LINKFOX_AGENT_API_KEY as a secret, and expect full Amazon operation responses to be saved locally under linkfox session folders. Run order/payment commands only after reviewing the plan and price.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tainted flow: 'req' from os.environ.get (line 68, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request destination is influenced by environment-controlled configuration via LINKFOX_TOOL_GATEWAY, and the outbound request includes sensitive headers such as the API key and session/application identifiers. In an agent/runtime context where environment variables may be manipulated, this can redirect authenticated traffic to an attacker-controlled endpoint and exfiltrate credentials and metadata.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST target is ultimately derived from environment-configurable base URLs, so a caller who can influence environment variables can redirect login and token-bearing requests to an attacker-controlled host. Because these requests include SMS login data, access tokens, refresh tokens, uid/tid headers, and other account metadata, this becomes a credential exfiltration and SSRF-style outbound data leak risk rather than a harmless configuration feature.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is built from environment-derived base configuration and then used in urlopen with the API key placed in the Authorization header. If an attacker can set LINKFOX_AGENT_API_URL or related variables, they can cause the tool to send the API key and billing/order traffic to an attacker-controlled endpoint, enabling secret theft and abuse of the linked account.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs use of shell scripts, network access via `/spApi/developerProxy`, environment variables such as `SESSION_ID`, and file writes to local disk, yet no permissions are declared. This creates a transparency and sandboxing gap: a host may grant broader runtime capabilities than users expect, and the skill can persist potentially sensitive Amazon operational data to disk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill writes full API responses, session metadata, and request context to local files under a persistent session directory. Fulfillment inbound responses can contain operationally sensitive business data such as shipment details, identifiers, labels, scheduling data, and possibly document contents, so broad local persistence expands exposure beyond the stated API-execution purpose and creates a confidentiality risk if the host, workspace, or logs are later accessed by other users or tools.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file's behavior is materially unrelated to the declared Amazon FBA inbound functionality and instead performs LinkFox account onboarding, SMS login, package sales, and payment QR generation. This skill-to-code mismatch is dangerous because it can trick users or host systems into granting trust and credentials under false pretenses while executing unrelated account and commerce operations.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code provisions accounts, retrieves/generates API tokens, and supports package purchasing even though those capabilities are not needed for Amazon inbound plan or shipment management. In this context, the extra billing and token-generation surface increases the chance of unauthorized account creation, monetization, and credential handling under the guise of an unrelated logistics integration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs users to persist an API key in shell startup files and environment variables, but provides no warning about secret handling, local exposure, shell history, or multi-user host risks. While this is common operational guidance, it can lead to credential leakage through dotfiles, process environments, backups, screenshots, or shared workstation access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The order command creates a billable order and writes a QR image to disk without an explicit confirmation gate or a clear warning that a paid transaction and filesystem side effect will occur. In an agent skill context, hidden commercial actions and local file creation are risky because users may invoke them indirectly or through automation without realizing they are being charged or that artifacts are persisted.

Static analysis

No suspicious patterns detected.