亚马逊-店铺订单

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.8

Overview

The skill does perform Amazon seller order operations, but it also handles sensitive order data, LinkFox account/billing onboarding, plaintext persistence, and configurable credential-bearing network endpoints in ways users should review carefully.

Install only if you trust the LinkFox gateway and are comfortable with it handling Amazon seller order data, account onboarding, and billing flows. Treat saved linkfox output files, stdout logs, phone login codes, API keys, and payment QR/order data as sensitive; avoid custom gateway environment variables, prefer secure secret storage over shell profiles, and require explicit confirmation before retrieving PII or creating paid orders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_spapi_orders_common.py:17

Finding

Credentials and sensitive order data can be redirected to an arbitrary endpoint

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding endpoints are similarly configurable: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return ...[truncated 2303 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_spapi_orders_common.py:190

Finding

Unsanitized SESSION_ID permits output path traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime( "%Y-%m-%d", _lf_time.localtime(ts), ) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join( data_dir, f"{slug}-{int(ts * 1_000_000)}.json", ) try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding QR output uses the same unsafe value: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a filesystem path component without validation. Values containing `..`, path separators, or absolute-path syntax can escape th ...[truncated 1246 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_spapi_orders_common.py:156

Finding

Complete restricted order responses are persistently stored without data minimization

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append( os.path.join(_lf_tempfile.gettempdir(), "linkfox") ) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root ``` ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime( "%Y-%m-%d", _lf_time.localtime(ts), ) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join( data_dir, f"{slug}-{int(ts * 1_000_000)}.json", ) try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` Sensitive responses are merged into the persisted result: ``` ...[truncated 2396 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:468

Finding

Generated API keys are exposed through standard output and plaintext shell profiles

Content

View full analysis

dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return { "error": f"login: invalid phone format: {phone}", "phone": masked, } if not re.fullmatch(r"\d{4,8}", code): return { "error": f"login: invalid verification-code format: {code}", "phone": masked, } lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token( lg["access_token"], lg["refresh_token"], ) if "error" in lbt: print( f"{TAG} {lbt['error']}", file=sys.stderr, ) info = _fetch_user_info_v3( lg["access_token"], lg["user_id"], ) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token( lg["access_token"], lg["user_id"], info["group_id"], ) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` The onboarding documentation recommends persistent plaintext storage: ```bash setx LINKFOX_AGENT_API_KEY " ...[truncated 1708 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Runtime installation guidance uses unpinned third-party dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing dependency: install qrcode and pillow with pip." print(f"{TAG} render_qr: {err}", file=sys.stderr) return { "png_path": None, "ascii_qr": None, "error": err, } ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing dependency: install requests with pip." ) ``` The dependency checker recommends installation without a verified version or integrity identifier: ```python "suggestedActions": [ ( "If a skill installer tool is available, install " f"'{REQUIRED_SKILL}' immediately." ), ( "Otherwise ask the user to install from " "https://skill.linkfox.com/ and retry." ), ], "marketplaceUrl": "https://skill.linkfox.com/", ``` ### Technical Analysis The Skill directs users to install Python packages by name without specifying reviewed versions, hashes, a lock file, or a trusted package-index policy. It similarly recommends installation of the required authentication Skill without specifying a version, release signature, or checksum. The reviewed code does not automatically execute `pip`, download a package, or install the external Skill. Exploitation therefore requires a user or Agent to follow the recommendation. Nevertheless, executing an unpinned package or Skill allows its future contents to differ from the version assumed during this audit. ### Attack Path 1. A user runs onboarding in an environment where `requests`, `qrcode`, or `pillow` is unavailable, or the authentication Skill is missing. 2. The user or A ...[truncated 802 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (57)

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The request destination and multiple outbound headers are influenced by environment variables, including the base URL and session metadata, and the Authorization key is then sent to that endpoint. If an attacker can control environment variables or runtime configuration, they can redirect requests to an arbitrary host and exfiltrate API credentials, session identifiers, and order-related data.

Content

Scanner excerpt · scripts/_spapi_orders_common.py (reported line 92)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill manifest says it handles Amazon seller order querying and fulfillment, but the code actually performs LinkFox account onboarding, SMS login, API-key retrieval, plan purchase, and payment QR generation. This is a severe capability mismatch that can trick users or orchestrators into invoking credential collection and commercial actions under a false Amazon-order-management pretense.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The POST target URL is derived from environment-controlled base URLs, so anyone who can influence the runtime environment can redirect requests to an attacker-controlled endpoint. Because these calls carry login data, access tokens, refresh tokens, user identifiers, and API-token generation traffic, this creates a realistic SSRF/exfiltration path rather than a harmless configuration feature.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request URL is also built from environment-controlled base configuration and then used by urllib with the Authorization header attached. If an attacker can set the environment, they can redirect authenticated gateway traffic and capture API keys or induce requests to unintended internal/external services.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向 Amazon Orders API 的业务技能，核心能力应是读取或更新订单与履约数据。实际代码完全没有网络请求、Amazon API 调用、订单字段处理或履约逻辑；它只读取环境变量、遍历本地目录、检查 SKILL.md 文件存在性，并输出依赖检查结果。这不是订单处理的辅助细节，而是一个 materially different 的主要功能。因此代码行为与声明用途明显不符，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个广泛的“订单查询与履约状态管理”技能，涵盖多个 Orders API 读写能力；但提供的代码片段只访问 orders/v0/orders/{orderId}/address 这一地址资源，作用限于获取单个订单的收货地址。虽然“收货地址”属于声明范围中的一个子能力，但代码的实际主功能远窄于声明的整体能力集合，且未体现多数关键触发场景（如搜索订单、确认发货、更新配送状态等）。此外，代码中还有明显实现问题（developer_proxy_call 使用了未定义的 seller_id），但这不改变其意图仍只是获取地址。因此应判定描述与该代码片段的实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

从资源范围看，代码确实属于亚马逊卖家订单领域，并且涉及声明中提到的“订单商品、买家信息”，因此总体业务域是一致的，不存在明显越权或无关资源访问。但声明描述的是一个覆盖搜索订单、详情、地址、发货确认、配送状态、管制订单和核验状态等多能力的订单管理技能，而该代码块只实现了单一接口 getOrderItemsBuyerInfo。按评估标准，仅因声明比单个代码块更宽泛通常不必判定不匹配；然而此代码还包含实质性行为偏差/缺陷：调用 developer_proxy_call 时传入了未定义的 seller_id，而不是 params['sellerId']，导致其核心功能很可能无法执行。因此，代码实际行为与声明的可用订单查询能力存在材料性不一致，判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是 Amazon 卖家 Orders API / 履约管理能力，重点应是商城订单搜索、订单详情、买家与地址信息、发货确认和配送状态更新等。实际代码完全未涉及 Amazon、卖家订单、履约、买家信息或收货地址，也没有 searchOrders/getOrder/confirmShipment 等行为。相反，代码围绕 LinkFox 平台的账号登录、短信验证码、团队信息、API token 获取、套餐购买与支付二维码生成展开，主要调用的是 linkfox.com 相关登录、账户、套餐和订单支付接口。因此该技能的实际用途与声明主用途明显不符，属于实质性描述-行为不匹配。

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs that full responses must always be written to disk, and those responses may include buyer information and shipping addresses. Persisting sensitive order and PII data by default without clear user warning, minimization, or retention controls creates unnecessary exposure through local compromise, backups, logs, or later unintended reuse.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

---

## Display Rules

1. 先看网关 **`developerProxy.errcode` / `httpStatus`**，再解析各脚本附加字段（如 **`searchOrders`**、**`order`**）。
2. **POST/PATCH** 脚本：`stdout` 中含 **`requestBody`**（组装后的 Amazon 请求体），便于排查。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 14)May include surrounding context.

md

- **`region`**：与 storeTokens 相同。
   - **`path`**：Amazon SP-API 相对 path，**无**前导 `/`。
   - **`method`**：`GET` | `POST` | `PATCH`。
   - **`amzAccessToken`**：上一步的 access token。
   - **`queryString`**（可选）：URL 查询串，不含 `?`。
   - **`body`**（POST/PATCH）：JSON 字符串。
   - **`contentType`**：如 `application/json`。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding document expands the skill from Amazon order lookup/fulfillment into handling unrelated account authentication, phone-based registration, and billing flows for the skill provider. That scope drift creates an unjustified path to collect credentials, personal data, and payments under the pretext of an Amazon orders skill, increasing phishing and abuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Asking users to provide a phone number so a script can register/login them and then purchase plans is not justified by the advertised Amazon seller order management function. In context, this looks like unauthorized account onboarding and monetization logic embedded in an unrelated operational skill, which could be abused for data harvesting or deceptive charges.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script calls developer_proxy_call with an undefined variable seller_id instead of the validated input params["sellerId"]. This will raise a runtime NameError and prevent shipment confirmations from being submitted, causing a denial of service for the skill’s core function. In an order-fulfillment context, failure to confirm shipments can disrupt operations, SLA compliance, and downstream order state management.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest and module docstring describe a skill for retrieving an Amazon order shipping address, but the actual request call passes seller_id, which is never defined in this file. This causes the script to fail at runtime before completing the described Orders API operation, creating a direct mismatch between claimed behavior and implemented behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script calls developer_proxy_call with an undefined variable seller_id instead of the validated params['sellerId'] value. This causes a runtime failure, preventing the buyer-info request from working and undermining order-processing reliability for a PII-related workflow. In this skill context, it is more of an availability/integrity defect than a direct security exploit, but it can break operational handling of sensitive order data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module docstring openly identifies the file as a LinkFox onboarding CLI, directly contradicting the Amazon-order-management manifest. Such explicit misalignment strongly suggests deceptive packaging and increases the likelihood that the skill is intended to smuggle unrelated credentialing and payment behavior past reviewers or users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill can create commercial orders and render payment QR codes, which is unrelated to Amazon store order lookup or fulfillment-state operations. In this context, it introduces unauthorized purchasing/billing functionality that could mislead users into making payments or trigger commercial transactions unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code implements SMS-based login, token handling, user/team discovery, and API key retrieval/generation for LinkFox, none of which are necessary for Amazon seller order management. In the context of a mislabeled skill, these functions are highly dangerous because they enable credential harvesting and privilege bootstrapping for a completely different platform.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares no explicit tool scope while its documented behavior uses environment variables, local file writes, shell execution, and network access. Missing scope boundaries increases the chance of over-broad execution and makes it harder to enforce least privilege for a skill that handles order and buyer data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are intentionally broad, saying the skill should activate even when the user does not explicitly mention the Orders API as long as they want to query or process Amazon store orders. Over-broad activation can cause unintended access attempts, unnecessary handling of order data, and accidental invocation in ambiguous conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

文件中的自然语言说明整体以中文固定表述技能触发与行为，没有提供语言/locale 选择或说明该技能仅面向特定中文环境。按照该规则，强制单一语言而无用户选择属于语言/地区策略风险。

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly requires always saving full Amazon order responses, including sensitive buyer and address data, into local session files. Even if intended for troubleshooting, default local persistence of raw order payloads broadens the attack surface and increases the blast radius of any host compromise or accidental file disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly enables access to buyer info, shipping address, and order item buyer data, which are restricted personal data, but it does not provide a clear operational warning to minimize collection, mask sensitive fields, or require explicit authorization before use. In a skill focused on order management, this increases the risk that downstream agents or users will retrieve and expose PII more broadly than necessary, especially since these endpoints are only briefly noted as deprecated/restricted near the end.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.