亚马逊-店铺定价

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.7

Overview

This pricing skill performs real Amazon pricing work, but it also includes account login and payment helpers that are too sensitive and broad for a pricing-focused package.

Install only if you trust LinkFox with the related account, store, and billing workflows. Prefer setting API keys through the dedicated auth skill or the official LinkFox site, avoid entering SMS codes or initiating payment orders from a pricing skill unless you intended that flow, do not set custom LinkFox endpoint environment variables unless you control them, and expect full pricing responses to be saved locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code sends authentication material and user data to a URL derived from environment-controlled base URLs via requests.post(). If an attacker can influence LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, SMS login codes, access tokens, refresh tokens, generated API keys, and related identifiers can be exfiltrated to an attacker-controlled server. In a skill environment, treating environment variables as trusted infrastructure is unsafe because they are an unverified external control plane.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request path uses urllib.request.urlopen() against a URL built from environment-controlled agent base configuration while attaching the API key in the Authorization header. If LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY is modified, the skill will transmit the bearer credential and business requests to an attacker-controlled endpoint, enabling credential theft and unauthorized downstream access. Because this file performs account, order, and package operations, the exposed token is materially sensitive.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises executable capabilities including environment access, file writes, network calls, and shell execution, but does not declare any permissions or constraints. This weakens user awareness and policy enforcement, increasing the chance that a caller invokes a skill with broader side effects than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is Amazon pricing queries, but the analyzed behavior reportedly includes SMS login, API key generation, account/package lookup, order creation, and payment QR generation. Hidden authentication and payment flows are highly sensitive and materially exceed the stated purpose, creating risk of credential capture, unauthorized billing actions, or deceptive user interaction.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill states both that the tool consumes points and later that it does not consume points. Contradictory cost disclosures can mislead users into unintended paid usage patterns or obscure the real consequences of repeated requests, especially where the skill also discusses balance exhaustion and recharge flows.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The pricing skill’s documentation instructs operators to invoke a separate onboarding helper that performs registration, login, and account setup flows unrelated to product pricing. This expands the skill’s effective scope into credential acquisition and account lifecycle handling, creating a risky trust boundary where an ostensibly pricing-only skill can solicit phone numbers, authentication codes, and API-key configuration.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documentation includes payment-plan listing, order creation, and payment status querying inside a pricing skill, which is not justified by the stated purpose of querying Amazon pricing APIs. Embedding billing purchase flows in this context can mislead users into authorizing charges through an unrelated tool and increases the chance of abuse, social engineering, or unauthorized commercial transactions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The shared helper writes full API responses to local session files regardless of content sensitivity. Pricing/proxy responses can include seller identifiers, marketplace context, offer data, and potentially error bodies or other returned data that exceed the skill's stated need, creating unnecessary local data exposure and retention risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a broad onboarding and monetization CLI—SMS login, API-key issuance, plan listing, order creation, payment QR generation, and order queries—which is unrelated to the stated Amazon store pricing function. That scope mismatch is dangerous because it introduces sensitive account and billing capabilities into a skill whose users would reasonably expect only pricing queries, increasing the chance of covert credential collection or unauthorized commercial actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create orders and render payment QR codes, giving the skill a direct billing and purchase capability not justified by an Amazon product-pricing integration. In context, this is especially risky because users invoking a pricing skill are unlikely to expect order creation or payment initiation, making accidental or deceptive monetization more plausible.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The file performs SMS-based account login and retrieves or generates LinkFox API tokens, which exceeds the minimal capability needed for a pricing-query skill. This introduces high-value credential-handling behavior into an unrelated context, increasing the risk of phishing-style collection of phone numbers, verification codes, access tokens, and long-lived API keys.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 87% confidence
• Finding: External transmission is expected for API integrations, but here it occurs in a component that handles SMS codes, access tokens, refresh tokens, and account metadata, and the destination can be indirectly controlled through environment-based base URLs. That makes the transmission materially dangerous because sensitive data may leave the trusted boundary without strong destination validation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.