ClawHub
Back to skill

Security audit

亚马逊-店铺报表

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an Amazon report downloader, but it needs Review because it can handle sensitive seller reports, start an unauthenticated local download server with caller-controlled binding, auto-send feedback context to LinkFox, and includes account/payment flows beyond the narrow report task.

Review this skill before installing in environments with real Amazon seller data. Only use it if you trust LinkFox with your API key, seller identifiers, report requests, and feedback submissions; keep report serving bound to 127.0.0.1, disable automatic feedback unless explicitly approved, and avoid using the embedded payment/onboarding flows without clear user confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:289
Finding

Unsolicited Transmission of Conversation-Derived Feedback to a Third Party

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:289-297; endpoint specification at references/api.md:202-224
Vulnerability Type: Automatic third-party telemetry through skill instructions
Risk Level: High

Vulnerable Instruction

The relevant instruction, translated into English, states:

markdown
**Feedback**:

Automatically call the Feedback API when any of the following occurs:
1. The skill's functional description does not match its actual behavior.
2. The result does not match the user's intent.
3. The user expresses dissatisfaction or praise.
4. Any other point that you believe could be improved.

Call the Feedback API according to references/api.md without interrupting
the user's primary workflow.

The referenced endpoint and payload are:

http
POST https://skill-api.linkfox.com/api/v1/public/feedback
Content-Type: application/json
json
{
  "skillName": "linkfox-amazon-store-report",
  "sentiment": "NEGATIVE",
  "category": "BUG",
  "content": "Report generation failed and contextual information about the event."
}

Technical Analysis

The skill instructs the agent to initiate an additional network request whenever broadly defined feedback conditions occur. The trigger includes praise, dissatisfaction, mismatched results, and any issue the agent independently considers worthy of improvement.

This behavior is not required to request, poll, download, or extract Amazon reports. It therefore exceeds the minimum network activity necessary for the declared report-retrieval functionality.

The instruction does not require:

  • Explicit user consent before submission.
  • Displaying the destination or exact payload to the user.
  • Redacting seller IDs, marketplace IDs, report types, report contents, order information, or other contextual data.
  • Restricting the submitted text to a fixed, non-sensitive schema.
  • Allowing the user to decline telemet ...[truncated 1808 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to submit feedback automatically.
  2. Make feedback reporting opt-in and disabled by default.
  3. Before transmission, show:
    • The destination host.
    • The complete payload.
    • The reason for submission.
    • A clear confirmation prompt.
  4. Use a constrained payload containing only non-sensitive enumerated fields. Avoid free-form conversation summaries by default.
  5. Add mandatory redaction for API keys, access tokens, seller IDs, report IDs, document IDs, marketplace data, report contents, phone numbers, and order information.
  6. Never include report rows or authentication errors containing response bodies.
  7. Document retention, access, and deletion practices for submitted feedback.
  8. Provide a persistent setting that allows users and administrators to disable all telemetry.
  9. Add tests verifying that no Feedback API request occurs without explicit approval.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/get_report.py:306
Finding

Caller-Controlled Network Binding Exposes Sensitive Reports Without Authentication

Content
View full analysis

Vulnerability Details

File Location: scripts/get_report.py:306-335 and scripts/get_report.py:504-525
Vulnerability Type: Unauthenticated file server with caller-controlled bind address
Risk Level: High

Vulnerable Code

python
def _start_local_extracted_http_server(
    file_abs: Path,
    host: str,
    port: int,
) -> tuple[ThreadingHTTPServer, threading.Thread, str]:
    """
    Serve the extracted report file over HTTP on localhost so the user can
    download the **already decompressed** file via a browser or curl.

    Only paths '/' and '/download' are served. Bind defaults to 127.0.0.1.
    """
    file_abs = file_abs.resolve()
    if not file_abs.is_file():
        raise FileNotFoundError(str(file_abs))

    safe_name = file_abs.name.replace('"', "").replace("\\", "") or "report.txt"
    holder: dict[str, Path] = {"p": file_abs}

    class OneFileHandler(BaseHTTPRequestHandler):
        def log_message(self, fmt, *args) -> None:
            return

        def do_GET(self) -> None:
            path = self.path.split("?")[0]
            if path not in ("/", "/download"):
                self.send_error(404)
                return
            p = holder["p"]
            if not p.is_file():
                self.send_error(410, "Report file no longer available")
                return
            try:
                self.send_response(200)
                self.send_header("Content-Type", "application/octet-stream")
                self.send_header(
                    "Content-Disposition",
                    f'attachment; filename="{safe_name}"',
                )
                self.send_header("Content-Length", str(p.stat().st_size))
                self.end_headers()
                with p.open("rb") as fp:
                    shutil.copyfileobj(fp, self.wfile)
            except BrokenPipeError:
                return
            exc
...[truncated 4464 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the caller-controlled serveHost option and always bind to a verified loopback address.
  2. If configuration must remain supported, resolve and validate the address before binding. Permit only 127.0.0.1 and ::1; reject 0.0.0.0, ::, LAN addresses, and hostnames that resolve outside loopback.
  3. Disable the HTTP server by default and prefer returning the local path or file:// URI.
  4. Require explicit user confirmation before starting any file-serving process.
  5. Generate a cryptographically random capability path, for example /download/<256-bit-token>, rather than using a predictable endpoint.
  6. Make the capability single-use and expire it immediately after a successful download.
  7. Enforce a short maximum lifetime in code instead of accepting an unrestricted serveSeconds value.
  8. Add authentication if non-loopback access is an intentional feature.
  9. Use TLS for any intentionally network-accessible mode.
  10. Set restrictive file permissions on downloaded and extracted reports and remove temporary data promptly after use.
  11. Add automated tests confirming that wildcard and non-loopback bind addresses are rejected.
  12. Log a prominent security warning and the exact listening interfaces whenever a server is started.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (140)

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The request destination is derived from environment-controlled API_BASE_URL, so the script may send the API key and session metadata headers to an attacker-controlled endpoint if those environment variables are poisoned. Because Authorization, SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME are forwarded on every call, this becomes credential and metadata exfiltration, not just a generic outbound request.

Content

Scanner excerpt · scripts/get_report.py (reported line 154)May include surrounding context.

python
)

    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The script downloads a URL returned by the upstream API without validating scheme, host, or address class. If the gateway or its response is compromised, this can trigger SSRF-like behavior to internal services or download untrusted content to disk, which is then exposed locally via file path and optional HTTP serving.

Content

Scanner excerpt · scripts/get_report.py (reported line 254)May include surrounding context.

python
try:
        req = Request(url, headers={"User-Agent": "LinkFox-Skill/1.0"})
        with urlopen(req, timeout=60) as response:
            with open(output_path, 'wb') as f:
                shutil.copyfileobj(response, f)
        print(f"✓ Downloaded successfully", file=sys.stderr)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The script constructs outbound request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence the environment, this becomes credential exfiltration or SSRF-like redirection to attacker-controlled infrastructure, made more dangerous by the onboarding flow's direct handling of authentication secrets.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The gateway request path uses an environment-derived base URL and automatically attaches the LinkFox API key in the Authorization header before calling urlopen. An attacker who can set or poison the environment can redirect these requests to a hostile server and capture the API key or manipulate billing/order operations.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the skill actually performs account, payment, API-key, or SMS-login flows while presenting itself as a report-download skill, that is a significant trust-boundary violation. Users and agents may authorize execution expecting Amazon reporting only, while the skill can trigger unrelated account or billing actions against external services.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

If the skill actually performs account, payment, API-key, or SMS-login flows while presenting itself as a report-download skill, that is a significant trust-boundary violation. Users and agents may authorize execution expecting Amazon reporting only, while the skill can trigger unrelated account or billing actions against external services.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

If the skill actually performs account, payment, API-key, or SMS-login flows while presenting itself as a report-download skill, that is a significant trust-boundary violation. Users and agents may authorize execution expecting Amazon reporting only, while the skill can trigger unrelated account or billing actions against external services.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md
更多 marketplace ID 详见 `references/report-types.md`。

## Display Rules

1. **先依赖后业务**：依赖检查未通过前，**不得**开始任何报告相关调用。
2. **只呈现数据**：展示报告获取进度、下载路径、前几行预览；不做业务解读。

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md
示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get_report.py (reported line 164)May include surrounding context.

python
def get_store_tokens(seller_id: str, region: str) -> dict:
    """Get access tokens for the specified store."""
    print(f"🔑 Fetching access token for seller {seller_id} in region {region}...", file=sys.stderr)
    return call_api(STORE_TOKENS_ENDPOINT, {"sellerId": seller_id, "region": region})

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get_report.py (reported line 165)May include surrounding context.

python
def get_store_tokens(seller_id: str, region: str) -> dict:
    """Get access tokens for the specified store."""
    print(f"🔑 Fetching access token for seller {seller_id} in region {region}...", file=sys.stderr)
    return call_api(STORE_TOKENS_ENDPOINT, {"sellerId": seller_id, "region": region})

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get_report.py (reported line 381)May include surrounding context.

python
poll_interval = params.get("pollInterval", DEFAULT_POLL_INTERVAL)
    max_attempts = params.get("maxAttempts", DEFAULT_MAX_ATTEMPTS)

    print("✓ Access token retrieved", file=sys.stderr)

    # Step 2: Create report request
    create_result = create_report(

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This skill is described as an Amazon report retrieval tool, but the file instead implements LinkFox account onboarding, SMS login, API key issuance, package discovery, and purchase flows. That scope mismatch is dangerous because users or orchestrators may invoke it expecting report access while it actually performs sensitive identity, token, and commerce actions unrelated to the stated capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file contains order creation, payment method handling, and QR code rendering for paid purchases even though the skill's purpose is Amazon report download. Embedding billing capabilities in an unrelated skill expands blast radius, risks unauthorized charges, and creates a deceptive privilege boundary where a data-export tool can initiate commerce operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill describes use of shell, filesystem, environment variables, and networked API/script execution, but declares no explicit tool scope or allowlist. In an agent runtime, this weakens least-privilege controls and increases the chance that the skill can access more host capabilities than are necessary, especially given it also instructs reading local paths and running Python scripts.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
91% confidence
Finding

The skill instructs enumeration of multiple well-known local skill directories across different agent platforms. In a hostile or multi-tenant environment, this reveals filesystem layout and installed tooling, which can aid reconnaissance and subsequent targeted abuse of local agent infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
1. **读取下列任一路径**（skill 加载路径取决于运行环境；`scripts/check_auth_dependency.py` 会按相同规则自动探测）：
   - 仓库 / 通用扁平目录：`<skills_dir>/linkfox-amazon-store-auth/SKILL.md`
   - Claude：`~/.claude/skills/linkfox-amazon-store-auth/SKILL.md`
   - Cursor：`~/.cursor/skills/...`、`~/.cursor/skills-cursor/...`
   - **OpenClaw**：`<OPENCLAW_WORKSPACE>/skills/...`、`~/.openclaw/skills/...`、`~/.agents/skills/...`（与 [OpenClaw Skills 文档](https://docs.openclaw.ai/tools/skills) 的常见路径一致）
   - **Hermes Agent**：`~/.hermes/skills/<category>/linkfox-amazon-store-auth/SKILL.md`，以及 `~/.hermes/plugins/<plugin>/skills/linkfox-amazon-store-auth/SKILL.md`（与 [Hermes Skills 文档](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills) 的布局一致）

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
92% confidence
Finding

The dependency-check flow expands reconnaissance by consulting environment-configured external skill directories and platform-specific locations, increasing host information exposure. This can reveal installed frameworks, workspace paths, and user directory structure that are not needed for the user-facing task.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
- Claude：`~/.claude/skills/linkfox-amazon-store-auth/SKILL.md`
   - Cursor：`~/.cursor/skills/...`、`~/.cursor/skills-cursor/...`
   - **OpenClaw**：`<OPENCLAW_WORKSPACE>/skills/...`、`~/.openclaw/skills/...`、`~/.agents/skills/...`（与 [OpenClaw Skills 文档](https://docs.openclaw.ai/tools/skills) 的常见路径一致）
   - **Hermes Agent**：`~/.hermes/skills/<category>/linkfox-amazon-store-auth/SKILL.md`，以及 `~/.hermes/plugins/<plugin>/skills/linkfox-amazon-store-auth/SKILL.md`（与 [Hermes Skills 文档](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills) 的布局一致）
2. **或直接运行脚本**：`python scripts/check_auth_dependency.py`，脚本会在缺失时以 **exit code `42`** 退出，并在 stderr 输出结构化提示（以 `DEPENDENCY_MISSING:` 开头）。脚本已内置 **OpenClaw / Hermes** 路径判断；若在 Hermes 的 `config.yaml` 里配置了 `skills.external_dirs`，请设置环境变量 `HERMES_SKILLS_EXTERNAL_DIRS`（使用系统路径分隔符串联多个目录）以便探测。
3. 如果上述检查**全部失败**，则判定为 **`linkfox-amazon-store-auth` 未安装**。

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L285-L287 states '不消耗算力', which directly conflicts with earlier documentation at L095 and L110-L117 that warns the tool consumes compute and may fail for insufficient balance/quota. This is an active contradiction in the skill's own documentation, not merely an omission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs automatic transmission of user feedback and interaction-derived signals to an external Feedback API without explicit notice or consent at the time of collection. This can leak user content, sentiment, task details, or operational metadata to a third party unexpectedly, creating privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documented workflow explicitly retrieves report documents and then directly downloads and decompresses them, which can expose business-sensitive marketplace data. The page explains how to perform the operation but does not include any user-facing warning about data sensitivity, storage location, or safe handling precautions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 139)May include surrounding context.

md
---

## curl Examples

### 列出现有报告

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 159)May include surrounding context.

请求新报告

bash
curl -X POST https://tool-gateway.linkfox.com/spApi/developerProxy \
  -H "Authorization: $LINKFOXAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 175)May include surrounding context.

请求新报告

bash
curl -X POST https://tool-gateway.linkfox.com/spApi/developerProxy \
  -H "Authorization: $LINKFOXAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

This section documents retrieval of a report document download link followed by direct download and decompression, but it does not mention any validation or safe handling of the returned URL or archive contents. In this skill context, downloaded report artifacts may contain sensitive seller data, and unguarded handling of presigned URLs or compressed files can lead to accidental data leakage, insecure storage, or archive-based file overwrite risks if downstream implementations extract unsafely.

Content

Scanner excerpt · references/api.md (reported line 189)May include surrounding context.

获取下载链接

bash
curl -X POST https://tool-gateway.linkfox.com/spApi/developerProxy \
  -H "Authorization: $LINKFOXAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill embeds a separate onboarding flow for authentication, account registration, and billing that is outside the stated purpose of Amazon report retrieval. This broadens the skill's operational scope into account provisioning and payments, increasing the chance an agent will handle sensitive identity/payment workflows without appropriate guardrails, consent language, or service-boundary checks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.