亚马逊-店铺Listing管理

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:42 PM UTC
• Version: 1.0.7

Overview

This skill mostly matches Amazon listing management, but it includes high-impact listing changes, automatic local response storage, and account/payment onboarding that users should review before installing.

Install only if you trust LinkFox with Amazon seller listing data and account onboarding. Use it with a dedicated, minimally scoped API key; keep gateway URL environment variables unset unless you intentionally use a trusted endpoint; avoid agent-initiated PATCH, PUT, or DELETE without an explicit review of sellerId, SKU, marketplace, and payload; and treat the generated linkfox response files as sensitive business data that may need cleanup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and the request carries sensitive data such as SMS login details, access tokens, refresh tokens, and generated API tokens. If an attacker can influence environment variables, they can redirect these authenticated requests to attacker-controlled infrastructure and exfiltrate credentials or manipulate onboarding flows.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is also constructed from environment-controlled configuration and is used with the API key in the Authorization header for account, package, and order operations. An attacker who can set the environment can cause the CLI to send the API key and business requests to an arbitrary endpoint, enabling credential theft and fraudulent order manipulation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes capabilities to read environment variables, write files, invoke shell scripts, and make network requests, yet no explicit permissions or trust boundaries are declared. This increases the risk that an agent or user invokes powerful operations without understanding the data exposure and execution surface, especially since the skill handles credentials and API responses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as an Amazon listings/SP-API tool, but the documentation also references onboarding, SMS verification, API-key generation, billing plans, order creation, and payment QR rendering. That mismatch widens the effective capability surface beyond user expectations, creating risk of credential collection, account actions, or payment-related flows being triggered under a misleading description.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The onboarding document directs operators to use a separate registration and billing workflow, including account creation, API-key retrieval, and payment handling, even though the skill is presented as an Amazon Listings capability. This expands the trust boundary and can socially engineer users into performing unrelated credentialing and payment actions through the skill, increasing phishing, account abuse, and misconfiguration risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper unconditionally serializes and writes full API responses to local storage under a predictable session directory. SP-API listing responses and related definition payloads can contain sensitive business data, and this persistence expands the skill’s behavior from transient API handling to local data retention, increasing exposure through disk leakage, unintended reuse, or access by other local users/processes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS login, API-key retrieval, plan listing, purchasing, and payment QR generation, which are unrelated to the declared Amazon Listings skill scope. Such scope mismatch is dangerous because it can trick users or a host agent into performing credential collection and billing operations they did not intend to authorize.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Embedding order creation, payment URL handling, and QR-code rendering introduces billing capability that has no justified relationship to Amazon listing management. In the context of a listings skill, this materially raises the risk of unauthorized charges, deceptive upsells, or abuse of agent trust boundaries.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs SMS-based login, token exchange, team selection, and API token generation, all outside the skill's stated Amazon Listings purpose. In this context, the skill is effectively a credential acquisition and account provisioning utility, which can harvest user access and expand privileges under misleading branding.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module documentation openly describes a LinkFox onboarding/account CLI rather than an Amazon store listings helper, contradicting the manifest. This discrepancy is a strong indicator of deceptive packaging and increases the likelihood that users or host systems will invoke risky account functions under false expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises PATCH, PUT, and DELETE listing operations, including destructive deletion, without a clear runtime confirmation or approval requirement. In an agent setting, this can lead to accidental or unauthorized modification/removal of storefront data if a prompt is ambiguous or maliciously crafted.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that full API responses are always written to the current working directory, potentially including seller identifiers, listing details, restrictions, schema data, or other sensitive business information. Silent persistence to local project directories increases the chance of data leakage through source control, backups, shared workspaces, or later prompt ingestion.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation describes PATCH, PUT, and DELETE operations that can modify or remove live Amazon listings, but it does not prominently warn operators about irreversible business impact, validation risks, or the need for explicit user confirmation before destructive actions. In an agent skill context, omission of such guardrails increases the chance that an automated workflow or inattentive operator will unintentionally alter or delete production listings.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs collecting a user's phone number and using it to trigger OTP-based registration, but provides no privacy notice, retention policy, or handling restrictions. In a skill context, this encourages unnecessary collection of sensitive personal data and creates risk of disclosure, misuse, or noncompliant processing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This script performs a full PUT create/update against Amazon Listings without an explicit confirmation or prominent warning at execution time, increasing the chance of accidental destructive or large-scope catalog changes. In an agent skill context, silent state-changing operations are more dangerous because users may expect informational behavior while the action modifies production seller data.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: This code transmits sensitive authentication and account-management data to external services. External transmission is especially risky here because the skill's declared scope does not justify handling login and token material, so the data flow is broader and more dangerous than users would expect.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.