ClawHub
Back to skill

Security audit

亚马逊-店铺Listing管理

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed Amazon listings manager, but it also handles account login, API-key generation, billing flows, write/delete store actions, and persistent storage in ways that need careful review before installation.

Install only if you are comfortable giving this skill authority over Amazon seller listing reads and writes, including create/update/delete operations, and over LinkFox account setup and billing assistance. Use it in a trusted environment, do not set custom LinkFox endpoint environment variables unless you control the destination, review any saved linkfox response files for sensitive seller data, and require explicit human confirmation before patch, put, delete, login, API-key generation, or payment/order steps.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/delete_listings_item.py:40
Finding

Unvalidated endpoint overrides can disclose API credentials and seller data

Content
View full analysis
dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding uses the same trust model for more sensitive authentication material: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "ht ...[truncated 3001 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_spapi_listings_common.py:59
Finding

Unvalidated SESSION_ID allows response-storage path traversal

Content
View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): """Persist complete response to linkfox///data/-.json.""" serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding implementation similarly uses the value directly: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name. No validation rejects: - `..` path components - ...[truncated 1825 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_spapi_listings_common.py:24
Finding

Complete seller responses are persisted without restrictive permissions or retention controls

Content
View full analysis
str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` ```python def emit_result(result, slug=SLUG, inline=False): """Persist complete response to linkfox///data/-.json.""" serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.pat ...[truncated 2545 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/onboarding.py:165
Finding

Onboarding recommends unpinned runtime dependency installation

Content
View full analysis
dict: try: import qrcode except ImportError: err = "Missing qrcode dependency, run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency, run: pip install requests") ``` ### Technical Analysis The onboarding script instructs users to install `qrcode`, `pillow`, and `requests` without exact versions, hashes, a lock file, or a required package index. The installed package versions therefore depend on the state of the configured Python package index at installation time. This is particularly relevant because `requests` is used for authentication operations that process: - Phone numbers and SMS verification codes - Access and refresh tokens - User and team identifiers - Generated API credentials The finding does not establish that any named dependency is malicious. The risk is the absence of reproducible and integrity-verified dependency resolution in a credential-sensitive workflow. ### Attack Path 1. The user invokes onboarding in an environment where `requests`, `qrcode`, or Pillow is absent. 2. The script displays an unpinned `pip install` command. 3. The user runs the command using a compromised, misconfigured, or attacker-controlled package index, or installs a future compromised package release. 4. Package installation or subsequent import executes package-controlled Python code with the user’s privileges. 5. A malicious dependency can inspect process credentials, intercept onboarding data, modify generated payment artifacts, or alter networ ...[truncated 523 chars]
Remediation
View remediation
--hash=sha256: qrcode== --hash=sha256: Pillow== --hash=sha256: ``` 3. Generate and maintain a lock file using a reproducible dependency-management tool. 4. Require a trusted package index and disable untrusted extra indexes. 5. Replace ad hoc installation messages with installation instructions referencing the project’s locked manifest. 6. Review and update pinned versions under a documented dependency-update process. 7. Run onboarding in an isolated virtual environment with minimum filesystem and environment access. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (62)

Tainted flow: 'req' from os.environ.get (line 99, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The request destination and several outbound headers are derived from environment variables, including the base URL and API credential, and are then sent via urlopen. If an attacker can influence the runtime environment, they can redirect requests to an attacker-controlled endpoint and exfiltrate the API key plus session-related metadata, which is especially sensitive in a skill that manages Amazon seller listings.

Content

Scanner excerpt · scripts/delete_listings_item.py (reported line 114)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 98, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The request destination is derived from environment variables (LINKFOX_TOOL_GATEWAY / STORE_API_BASE_URL / SPAPI_BASE_URL), and the same request carries sensitive material including the Authorization API key plus seller and session-related headers. If an attacker can influence the runtime environment, they can redirect requests to an attacker-controlled endpoint and exfiltrate credentials and tenant metadata.

Content

Scanner excerpt · scripts/get_definitions_product_type.py (reported line 113)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 102, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The request destination is derived from environment variables such as LINKFOX_TOOL_GATEWAY / STORE_API_BASE_URL / SPAPI_BASE_URL, and the code sends sensitive data including the API key, sellerId, and session-related headers to that endpoint. If an attacker can influence the environment, they can redirect requests to an attacker-controlled server and exfiltrate credentials and seller/session metadata.

Content

Scanner excerpt · scripts/get_listings_item.py (reported line 117)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 98, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request destination is influenced by environment variables such as LINKFOX_TOOL_GATEWAY, STORE_API_BASE_URL, or SPAPI_BASE_URL, and the same request includes sensitive headers like the API key and session-related identifiers. If an attacker can control the runtime environment, they can redirect requests to an arbitrary host and exfiltrate credentials and seller/session metadata, creating an SSRF-style credential leakage issue.

Content

Scanner excerpt · scripts/get_listings_restrictions.py (reported line 113)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive onboarding data, access tokens, refresh tokens, generated API keys, and payment-related requests to those endpoints with no allowlist or host validation. If an attacker can influence environment variables in the skill runtime, they can redirect authentication and billing traffic to attacker-controlled infrastructure and capture credentials or tokens.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The gateway request path uses an environment-derived base URL and attaches the API key in the Authorization header before calling urlopen. In a compromised or multi-tenant environment, a malicious override of LINKFOX_AGENT_API_URL or fallback variables would exfiltrate the API key and redirect account, package, order, and billing operations to an attacker-controlled server.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 104, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The request destination is derived from environment-controlled base URL variables, and the code sends the API key plus seller/account metadata to that endpoint without validating or allowlisting the host. If an attacker can influence the environment, they can redirect requests to an attacker-controlled server and exfiltrate credentials and sensitive marketplace data.

Content

Scanner excerpt · scripts/patch_listings_item.py (reported line 119)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 103, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
97% confidence
Finding

The request destination is derived from environment variables (LINKFOX_TOOL_GATEWAY / STORE_API_BASE_URL / SPAPI_BASE_URL), and the code sends sensitive headers including the API key and session metadata to whatever endpoint those variables specify. If an attacker can influence the runtime environment, they can redirect traffic to an attacker-controlled server and exfiltrate credentials and request contents, making this an SSRF-style credential-leak issue.

Content

Scanner excerpt · scripts/put_listings_item.py (reported line 118)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 101, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The request destination and multiple outbound headers are built from environment variables, including the base URL and session-related identifiers, and then sent via urlopen. If an attacker can influence the process environment, they can redirect requests to an arbitrary server and exfiltrate the API key, seller identifier context, and session metadata; in this skill context, those credentials can enable unauthorized access to Amazon seller operations.

Content

Scanner excerpt · scripts/search_definitions_product_types.py (reported line 116)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 103, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The request destination is influenced by environment variables (LINKFOX_TOOL_GATEWAY, STORE_API_BASE_URL, SPAPI_BASE_URL), and the same request carries sensitive headers including the API key and session metadata. If an attacker can alter the environment or runtime configuration, they can redirect traffic to an attacker-controlled endpoint and exfiltrate credentials and seller/session identifiers.

Content

Scanner excerpt · scripts/search_listings_items.py (reported line 118)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is described as an Amazon Listings management skill, but the documented prerequisite flow includes local dependency scanning and environment inspection via a check script. Undisclosed local discovery behavior can surprise users and may expose filesystem layout or environment-derived secrets in contexts where only business API operations were expected.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is described as an Amazon Listings management skill, but the documented prerequisite flow includes local dependency scanning and environment inspection via a check script. Undisclosed local discovery behavior can surprise users and may expose filesystem layout or environment-derived secrets in contexts where only business API operations were expected.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
---

## Display Rules

1. **items** 类接口：路径含 **卖家 SKU** 时强调非 ASIN；**searchListingsItems** 路径仅到 `sellerId`。
2. 展示网关结果时说明 **`errcode` / `httpStatus`**；成功后再解析 `body`（`listing` / `searchResult` / `patchResult` / `putResult` / `deleteResult` / **`restrictionsResult`** / **`productTypesSearchResult`** / **`productTypeDefinitionResult`**）。

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md
示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This file implements LinkFox account onboarding, SMS login, API-key retrieval, package purchasing, and payment QR generation, which is materially unrelated to the declared Amazon listing-management skill. That mismatch is dangerous because it introduces hidden identity, credential, and billing behaviors users would not reasonably expect when invoking an Amazon listings tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The package listing, order creation, payment URL retrieval, and QR rendering add billing capabilities that are not justified by an Amazon listings-management function. In skill context, this is more dangerous because a user asking to manage product listings could instead be steered into unintended purchases or payment flows outside the advertised purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill performs SMS-based login, token exchange, team discovery, and API token generation for LinkFox accounts, all outside the stated Amazon listing-management scope. This creates an unnecessary secret-handling surface and could capture or mint credentials under misleading context, increasing the risk of account compromise and unauthorized downstream API use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises executable behaviors involving environment access, file writes, network calls, and shell execution, but does not declare any explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it harder for the host or reviewer to constrain what the skill may do, increasing the risk of unintended data access or command execution if the surrounding scripts are unsafe.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is very broad and says the skill should fire even when the user does not explicitly mention the API, for many generic listing-related requests. Overbroad invocation criteria can cause the agent to activate a networked, write-capable commerce skill in situations where the user intended only discussion or analysis, increasing the risk of unintended store actions or unnecessary data handling.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs that complete API responses must always be written to the working directory under a predictable path. Listings, restrictions, and product-type responses can contain seller identifiers, SKU data, catalog details, and operational metadata, so unconditional persistence increases the chance of cross-task leakage, accidental commit to source control, or later access by other tools/users on the same workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill documents deletion of listings but does not pair that destructive action with explicit safety guidance such as confirmation requirements, scope checks, or rollback limitations. In an agent setting, this increases the chance of accidental or overbroad deletion of seller listings, causing operational and revenue impact.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 519)May include surrounding context.

md
---

## curl 示例（两步：取令牌 + 代理 GET / PATCH / PUT / DELETE）

**1）取 `accessToken`（与 store-report 相同）**

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 550)May include surrounding context.

3）searchListingsItems（path 仅到 sellerId，query 含 marketplaceIds 与分页等）

bash
curl -sS -X POST "https://tool-gateway.linkfox.com/spApi/developerProxy" \
  -H "Authorization: $LINKFOXAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 567)May include surrounding context.

3）searchListingsItems（path 仅到 sellerId，query 含 marketplaceIds 与分页等）

bash
curl -sS -X POST "https://tool-gateway.linkfox.com/spApi/developerProxy" \
  -H "Authorization: $LINKFOXAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 586)May include surrounding context.

3）searchListingsItems（path 仅到 sellerId，query 含 marketplaceIds 与分页等）

bash
curl -sS -X POST "https://tool-gateway.linkfox.com/spApi/developerProxy" \
  -H "Authorization: $LINKFOXAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.