亚马逊-店铺Fulfillment Outbound

• Outcome: Review
• Latest audit: Aug 18, 2026 · 11:52 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches Amazon MCF fulfillment, but it also bundles under-disclosed LinkFox account, payment, and API-token tooling that users should review before installing.

Install only if you intentionally want a LinkFox-backed Amazon MCF skill and are comfortable with local full-response storage. Keep LINKFOX_AGENT_API_KEY and gateway-related environment variables controlled, clear the local linkfox output/cache directories when they contain sensitive order or invoice data, and avoid using the bundled onboarding/payment commands unless you explicitly intend those LinkFox account actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and the function transmits sensitive login material, SMS codes, access tokens, and group/token-management requests to that destination. In a skill/runtime environment where env vars can be influenced by a wrapper, operator, or compromised host, this becomes an SSRF/exfiltration primitive that can redirect credentials and issued API keys to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request URL is constructed from an environment-derived base and then used with the Authorization header populated from LINKFOX API key material. If an attacker can influence the environment, the code will send the API key and order/account requests to an arbitrary endpoint, enabling credential theft and unauthorized access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill explicitly instructs use of shell commands, network access, environment-derived session context, and persistent file writes, yet no permission model is declared. This creates an over-privileged/opaque execution surface where users and hosting platforms cannot easily reason about what the skill is allowed to do, increasing the chance of unexpected data access or side effects.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module documentation explicitly says output must not be written to `/tmp`, but `_linkfox_root()` falls back to `tempfile.gettempdir()`. This can place potentially sensitive API responses in a less controlled shared temporary location, violating the stated data-handling policy and increasing exposure risk on multi-user or containerized systems.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill persistently writes full API responses, cache entries, and session metadata to local disk under a predictable workspace directory, even though the skill’s purpose is to broker fulfillment API operations. Fulfillment outbound and invoice-header responses can contain sensitive business and customer data such as names, addresses, tracking details, proof-of-delivery fields, and billing metadata, so unconditional local retention materially expands the data exposure surface beyond the API transaction itself.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a LinkFox onboarding, SMS login, API-key issuance, subscription purchase, and payment QR workflow that is unrelated to the declared Amazon MCF fulfillment/invoice functionality. That scope mismatch is dangerous because users or hosting agents may grant trust and secrets for Amazon operations while the skill also performs account bootstrap and commerce actions for a separate platform.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can fetch or generate API tokens for a group after SMS login, which is a high-risk credential-issuance capability unrelated to fulfillment outbound actions. In context, this can be used to mint reusable LinkFox API credentials for the authenticated user/team, expanding access well beyond the stated Amazon MCF purpose and enabling persistent account compromise if abused.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The package listing, order creation, payment link/QR generation, and order status logic introduce billing and commerce capabilities outside the declared Amazon fulfillment scope. This broadens the attack surface and creates risk of unauthorized purchases or deceptive monetization under the cover of a fulfillment integration.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill sends `SESSION_ID`, `MODE_ID`, and `APP_NAME` to an external LinkFox gateway on every request. Even if not secrets, these values are workflow and environment metadata that may enable tracking, correlation, or leakage of internal context without clear localized disclosure or minimization.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The code writes payment QR PNG files into local session directories, potentially leaving sensitive payment artifacts on disk where other local users, later processes, or support tooling may access them. While not inherently malicious, storing payment data without prominent disclosure or lifecycle controls creates avoidable privacy and operational risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill says it will always write full API responses to session files, and those responses may contain order details, tracking data, proof-of-delivery metadata, invoice headers, recipient information, and other commercially or personally sensitive records. Persisting complete responses by default broadens exposure through local compromise, over-retention, backups, log collection, or accidental sharing beyond what is needed for the immediate task.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.