Linkfox 亚马逊店铺运营

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:59 PM UTC
• Version: 1.2.3

Overview

This skill is a coherent Amazon seller operations integration, but it handles high-impact store access, tokens, local data retention, and write actions in ways users should review carefully before installing.

Install only if you intend to give this skill broad Amazon seller-account operational access through LinkFox. Keep LINKFOX_TOOL_GATEWAY and related base-url environment variables pinned to trusted LinkFox hosts, avoid sharing saved linkfox response directories, delete old session data after use, and require explicit confirmation before any listing, feed, shipment, A+ content, upload, or fulfillment change.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (57)

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request destination is derived from environment-controlled base URL values and then sent via urlopen with the Authorization header attached. If an attacker can influence LINKFOX_TOOL_GATEWAY, STORE_API_BASE_URL, or SPAPI_BASE_URL, they can redirect the request and exfiltrate the API key to an arbitrary server, making this a real SSRF/credential-leak issue.

Tainted flow: 'req' from os.environ.get (line 46, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen is influenced by environment-derived configuration, including the base URL and API key. In an agent/skill context, allowing a sensitive authenticated request to be redirected to an environment-controlled endpoint can exfiltrate the API key and any returned store data to an attacker-controlled service.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, and sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens are sent to that destination. In a skill/agent environment, environment variables may be influenced by the host or deployment config, so this creates an SSRF/exfiltration path to attacker-controlled endpoints.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request uses a URL assembled from environment-controlled LINKFOX_AGENT_API_URL/LINKFOX_TOOL_GATEWAY and attaches the API key from environment in the Authorization header. If that base URL is redirected to an attacker-controlled server, the skill will disclose the API key and perform authenticated requests against an arbitrary endpoint.

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request URL is derived from environment variables (LINKFOX_TOOL_GATEWAY / STORE_API_BASE_URL / SPAPI_BASE_URL), and the script sends the Authorization API key to whatever host those variables specify. In an agent or multi-tenant runtime, a poisoned environment could redirect requests to an attacker-controlled endpoint and exfiltrate credentials and seller-linked token data.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document’s 'best practice' claims tokens are not exposed to the frontend, but earlier APIs explicitly return both accessToken and refreshToken to the caller. That contradiction is security-significant because it normalizes direct credential disclosure while asserting the opposite, increasing the chance implementers and reviewers miss the exposure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The shared helper goes beyond API transport and persistently stores full API responses, session metadata, and an index on local disk. Because this module handles store tokens and proxied Amazon API data, broad automatic logging creates an unnecessary data-retention surface and increases the chance of sensitive business data leaking from workspace, home, or temp directories.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper adds persistent local storage behavior that is broader than its stated purpose as a shared catalog API utility. Because it writes full API responses into predictable local directories, it can retain seller, catalog, and possibly token-adjacent operational data on disk longer than users expect, increasing exposure on shared or multi-user systems.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code explicitly serializes and writes full API responses plus session metadata to disk under predictable local directories, despite comments/docstrings suggesting 'no cache'. Customer feedback API responses and proxy outputs may contain sensitive business data, tokens in error payloads, or other confidential content that then persists beyond the session and can be read by other local processes or users.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The module docstring describes only shared API helpers, but the file also implements a substantial persistence layer that writes full API responses and session metadata to disk. This mismatch obscures material data-handling behavior, making it easier for operators or reviewers to miss that potentially sensitive Amazon/store data is being retained locally.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The appended persistence layer writes complete API responses and session metadata to local disk under predictable directories unrelated to the core Uploads helper purpose. Because these responses may contain store tokens, upload destinations, document metadata, or other sensitive business data, this creates unnecessary at-rest retention and expands the exposure surface if the host, workspace, or temp directories are accessible to other users or processes.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script starts a local HTTP server to expose the downloaded report file, which expands the attack surface beyond simple retrieval. Although it binds to localhost by default, the host is user-configurable and the feature is enabled by default, so sensitive report contents may be exposed to other local users, container peers, or broader networks if bound to `0.0.0.0`.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The output layer persistently writes full results and metadata into a `linkfox` directory outside the temporary report folder, potentially storing sensitive paths, report identifiers, local URIs, and optional source URLs beyond the expected execution lifetime. This broadens data retention and makes accidental disclosure more likely, especially on shared systems or agent workspaces.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The skill metadata uses very broad trigger language such as general Amazon store operations, orders, listings, pricing, reports, uploads, and FBA workflows. This can cause the skill to activate in contexts where the user did not explicitly intend Amazon SP-API actions, increasing the chance of unnecessary access to store-integrated capabilities and accidental exposure or modification of business data.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The routing guidance encourages broad natural-language matching across many sub-capabilities and says to recommend tools whenever multiple capabilities may fit. Without stricter activation gates, this increases the risk of over-invocation of authenticated tools, including write-capable operations like listings, feeds, A+ content, and shipment confirmation, based on ambiguous user phrasing.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The refresh endpoint is documented to return both a new access token and the refresh token to the caller. Exposing long-lived refresh tokens to clients greatly increases account compromise risk because anyone who obtains the token can mint fresh access tokens and retain persistent access.

Missing User Warnings

High

• Confidence: 100% confidence
• Finding: The documented storeTokens endpoint retrieves and returns stored access and refresh tokens directly from the database to the requester. This turns the service into a credential-exfiltration endpoint: any account/session compromise, excessive internal access, logging exposure, or client misuse can immediately leak reusable secrets for downstream Amazon store access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly states that `/spApi/storeTokens` and `/spApi/refreshToken` return full `accessToken` and `refreshToken`, and instructs that the `accessToken` be passed to downstream skills. Although later sections mention masking tokens for display, this section normalizes broad token handling and cross-skill transfer of live credentials, increasing the chance of secret exposure through logs, prompts, or downstream components.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill mandates automatic persistence of complete API responses to local JSON files, and these responses can include `accessToken` and `refreshToken` per the API reference. Storing full secrets on disk by default expands the attack surface to local filesystem compromise, accidental inclusion in artifacts, backups, or later prompt/context leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents that full API responses are always written to a persistent local path under the working directory, and may also be printed inline. Catalog API responses can contain commercially sensitive product data, identifiers, and query history; persisting them by default without a user-facing warning, consent step, retention policy, or redaction increases the chance of unintended disclosure to other local users, logs, backups, or later agent steps. The skill context makes this more concerning because it handles store-linked API data and encourages saving complete responses even when only a subset is needed.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill exposes multiple state-changing operations such as create, update, delete, cancel, and scheduling actions against Amazon FBA/MCF resources, but it does not define a consistent warning or explicit confirmation requirement before performing them. In an agent setting, this increases the risk of unintended inventory, shipment, or fulfillment changes caused by ambiguous user requests or over-eager automation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly states that complete API responses are always written to disk, while the documented endpoints include buyer info, shipping address, and other potentially restricted order data. Persisting full responses by default without explicit minimization, masking, retention controls, or a strong warning materially increases the chance of local PII exposure through filesystem access, backups, logs, or shared workspaces.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly states that complete API responses are always written to local disk, and those responses can include pricing data, seller identifiers, request bodies, and potentially operational or account-related details. Persistent storage without an explicit opt-in, minimization, retention policy, or strong warning increases the risk of unintended data exposure through shared workspaces, backups, or later compromise of the host environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly starts a temporary local HTTP server to expose an extracted Amazon report file, which may contain sensitive seller data such as orders, inventory, traffic, or financial information. Although it notes the link is only usable on the same machine and for a limited time, it does not clearly warn about the confidentiality risk of exposing plaintext report data over local HTTP or discuss localhost binding, access scope, or accidental exposure via shared hosts, remote desktop sessions, port forwarding, or local malware.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs users to upload files directly to a returned pre-signed URL outside the gateway, but it does not clearly warn that file contents will be transmitted to an external endpoint nor that the returned upload metadata may be sensitive. In this context, pre-signed URLs and required headers can function as temporary write credentials, so users may unknowingly expose data or misuse upload destinations without understanding the trust boundary.

Static analysis

No suspicious patterns detected.