亚马逊-店铺订单

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.7

Overview

This Amazon Orders skill has real order-management functionality, but it also bundles account, billing, payment, sensitive-data persistence, and state-changing workflows that need careful review before use.

Install only if you trust LinkFox with Amazon order data, buyer/address information, and account or billing workflows. Before use, review endpoint environment variables, avoid routing credentials to custom hosts, confirm any payment or order-state update manually, and delete or protect saved linkfox response files because they may contain sensitive customer data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The code sends authentication material and user data to URLs derived from environment-controlled base endpoints via requests.post. If an attacker or untrusted deployment wrapper can set LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect SMS login, access tokens, refresh tokens, and generated API keys to attacker-controlled infrastructure. In the context of an Amazon Orders skill, this off-manifest onboarding/login behavior makes the exfiltration risk more suspicious and dangerous.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request target is built from environment-controlled base URL input and then used in urlopen with the bearer API key attached. A malicious or compromised runtime can redirect these calls to capture LINKFOX_AGENT_API_KEY and order/account data, enabling credential theft and unauthorized API use. Because this file is unrelated to the declared Amazon Orders functionality, the credential exposure is especially risky.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares capabilities to use environment variables, write files, access the network, and invoke shell/Python scripts, but does not declare permissions or constrain them in the skill metadata. This weakens reviewability and increases the chance that a user or host system grants broader access than expected, especially because the skill handles order and buyer-related data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is Amazon Orders access, but the behavior reportedly includes LinkFox account login, API key generation, billing/recharge flows, payment QR generation, payment-status polling, and local scanning for dependency skills. Hidden auth and payment-related behaviors substantially expand the trust boundary and can expose credentials, billing actions, or local environment information beyond what a user expects from an order-query skill.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill first warns that using the tool consumes credits, then later states that it does not consume credits. Inconsistent billing semantics can mislead users into approving actions they would not otherwise authorize, and can hide financial side effects of repeated API usage or fallback flows.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The onboarding document introduces account recovery, registration, API key acquisition, and billing workflows that are unrelated to an Amazon Orders skill’s declared purpose. This expands the skill’s operational scope into credential handling and payment enablement, increasing the chance of social-engineering abuse, unauthorized data collection, and unsafe operator actions outside the expected Amazon SP-API order functionality.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs the operator to collect a user’s phone number, send verification codes, log in, and initiate plan purchases even though none of this is justified by the stated Amazon order-management purpose. In context, this creates an unjustified pathway for collecting personal data and facilitating payments, which is especially dangerous because users may trust the skill as part of a normal orders workflow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The shared helper persists full API responses and session metadata to local disk under predictable workspace/temp/home locations, even though Orders responses can contain buyer information, addresses, and shipment details. This creates unnecessary local data retention and expands exposure beyond the stated API-calling purpose, especially on shared hosts or systems with weak filesystem isolation.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script validates that `sellerId` is required but then calls `developer_proxy_call(..., seller_id)` using an undefined variable instead of `params["sellerId"]`. This creates a functional defect that can crash the script or cause incorrect identity binding if a global `seller_id` were ever introduced, undermining access-control assumptions around which seller account is being queried.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This file implements SMS login, API-key issuance, plan listing, purchase flow, and payment QR generation, which are unrelated to an Amazon Orders skill. Such hidden onboarding and payment capability broadens the attack surface, collects sensitive user data, and can be used to monetize or divert users outside the stated skill purpose. The mismatch between manifest and code substantially increases suspicion.

Description-Behavior Mismatch

Critical

• Confidence: 99% confidence
• Finding: The executable CLI behavior is wholly inconsistent with the manifest: instead of Amazon SP-API Orders operations, it performs phone-based account onboarding, token retrieval, package purchase, and payment handling. A complete scope mismatch is a strong indicator of deceptive packaging, creating risk of credential harvesting, unauthorized billing flows, and user redirection under false pretenses. Skill-context mismatch makes this more dangerous than the same code in a clearly labeled onboarding utility.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The call to developer_proxy_call passes an undefined variable seller_id instead of the validated input params["sellerId"]. This causes the update operation to fail at runtime, creating a reliability and integrity issue where the skill advertises a state-changing verification update capability but cannot actually perform it, which can break workflows or lead operators to assume regulated-order verification was processed when it was not.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger conditions include broad natural-language phrases around Amazon orders, which can cause the skill to activate on loosely related requests. Because the skill can access and persist order, buyer, and address data and perform shipment-related updates, accidental invocation raises the risk of unnecessary data exposure or unintended state-changing actions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly supports retrieving buyer information, shipping addresses, and order details, and its output strategy says complete responses are persisted and sometimes printed, but it does not provide strong privacy warnings or consent requirements. This is dangerous because SP-API order responses may contain PII and regulated data, and local persistence plus stdout exposure broadens the number of places sensitive data can leak.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation explicitly routes Amazon order, buyer, and shipping-related data through a gateway proxy and token exchange flow, but it does not clearly warn users that personally identifiable and potentially restricted order data will transit and potentially be logged outside Amazon's native endpoint surface. In this skill context, that omission is meaningful because the documented APIs include buyer info, addresses, and regulated-order details, which increases privacy and compliance risk if operators or users do not understand the data handling implications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document tells the operator to ask for a user’s phone number and run registration/login commands without warning about handling personal data, verifying user consent, or protecting secrets returned by the script. That omission can lead to unnecessary collection of sensitive data and accidental exposure of verification artifacts or API keys during support interactions.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: emit_result writes complete serialized responses to disk and announces the saved path, without warning the user that Amazon order data may be retained locally. Because this skill handles Orders APIs that can return PII and commerce data, silent full-response logging materially increases confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This skill retrieves and emits a customer's shipping address, which is sensitive personal data, and returns it directly in the result object via `merge_json_body(out, proxy, "shippingAddress")`. In the SP-API orders context, exposing buyer address data without explicit purpose limitation, authorization checks, masking, or minimization increases the risk of privacy violations and unauthorized disclosure of PII.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This script retrieves and emits buyer information from the Amazon Orders API, which may include PII, yet it provides no explicit gating, warning, minimization, or output redaction at this layer. In the context of an agent skill that can be triggered by natural-language requests about orders and buyer info, this increases the risk of overexposing sensitive customer data to downstream consumers or logs if authorization and RDT/PII controls are incomplete elsewhere.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script is designed to retrieve and emit Amazon order item buyer information, which is sensitive customer data, with no built-in minimization, masking, authorization gate, or user-facing disclosure at the point of output. In this skill context, that is more dangerous because the capability is explicitly about Orders API access and may expose PII to downstream consumers or logs if invoked by an over-broadly authorized agent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script performs a state-changing POST to update Amazon order shipment status immediately from supplied arguments, with no interactive confirmation, dry-run mode, or secondary guardrail. In an agent skill context, this increases the chance of accidental or unauthorized order-state changes, which can affect fulfillment workflows, compliance, and customer experience.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill instructs that complete API responses must always be written to session-linked local JSON files, and those responses may include buyer info, addresses, and other order data. Mandatory persistence of full sensitive payloads creates durable local copies that can be accessed by other processes, accidentally committed, or retained longer than necessary.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.