亚马逊-店铺报表

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:54 PM UTC
• Version: 1.0.7

Overview

The skill does fetch Amazon seller reports as advertised, but it also includes account/billing/payment flows, automatic feedback reporting, and default local serving/persistence of sensitive report data.

Install only if you are comfortable letting this skill access LinkFox/Amazon report APIs, download sensitive seller reports locally, keep short-lived localhost download links, write report metadata under a linkfox workspace, and use the bundled onboarding/payment and feedback-reporting flows. Before use, disable local HTTP serving for sensitive reports when possible, avoid sharing generated URLs or saved files, confirm any purchase/order step explicitly, and review where API keys and report files will be stored.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill describes capabilities to read environment variables, enumerate/read files, write local files, invoke shell commands, and make network requests, but it does not declare permissions or present an explicit consent boundary. That creates a transparency and governance gap: operators cannot accurately assess what the skill may access, and users may trigger sensitive local and network actions without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A description-behavior mismatch is dangerous because it hides materially different operations behind a benign-seeming report-download skill. If the skill also performs account login, API key generation, payment/ordering flows, local metadata persistence, and documentation rewriting, it can collect credentials, initiate purchases, or alter local content outside the user's reasonable expectations.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill states both that tool usage may consume credits and that the skill does not consume credits, which is a materially misleading billing statement. Users could be induced to authorize repeated operations under false assumptions about cost, creating financial harm and trust issues.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document explicitly states that this sales tax report cannot be requested or scheduled via CreateReport, yet it provides CreateReport request examples as if normal API creation were supported. In an automation skill that pulls Amazon reports end-to-end, this inconsistency can cause agents or downstream tooling to make invalid API calls, fail unexpectedly, or mishandle restricted-report workflows that may require manual generation and additional access controls.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script persists full result metadata to a separate LinkFox workspace on disk, including report identifiers, local file paths, temp directories, and optionally Amazon source URLs. Because Amazon reports may contain sensitive business data, retaining derived metadata outside the immediate download flow increases exposure, enables unintended cross-session discovery, and may violate least-retention expectations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The embedded session logging/archive subsystem creates cross-session metadata such as session IDs, skill usage, file indexes, and data file references unrelated to the core report-download function. In a skill handling potentially sensitive seller reports, this broad archival behavior increases data discoverability and forensic footprint beyond user expectations, especially on shared hosts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements account onboarding, SMS login, API key retrieval, package listing, and order/payment workflows that are materially unrelated to the advertised Amazon report retrieval purpose. In a skill context, this expands the trust boundary to credential collection and billing actions, creating a dangerous capability mismatch that could mislead users into granting access or initiating purchases they did not expect.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes, which is a strong monetization capability unrelated to fetching Amazon seller reports. In this skill context, hidden or bundled payment functionality is especially risky because it can trigger financial actions under the guise of operational automation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger conditions are so broad that almost any request involving Amazon seller structured data may invoke this skill. Overbroad invocation increases the chance of unintended network calls, local file writes, report generation, and HTTP serving in contexts where the user did not actually ask for those actions.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill is designed to automatically download remote content, decompress it, write it to disk, and start a temporary local HTTP server without explicit opt-in. This can expose sensitive business data on the local machine, expand untrusted archives, and create an unintended data-access surface via the browser-accessible URL.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Automatic feedback reporting to an external API without a privacy notice or consent can leak user prompts, operational metadata, dissatisfaction signals, or report context. Because this occurs 'automatically' and 'without interrupting the main flow,' users may never realize their interaction details are being transmitted off-device.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding flow instructs the operator to collect and process a user's phone number and verification code through a local script, but it does not include any privacy notice, consent language, retention limits, or handling safeguards. This creates a real privacy and compliance risk because sensitive personal data is being solicited and transmitted without documented data-handling expectations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This document explicitly describes retrieval of customer personal data, including contact information, page-view behavior, and order data, but provides no warning, handling requirements, access restrictions, or retention guidance. In the context of a skill that automates report download, extraction, and local HTTP exposure, the absence of privacy and secure-handling guidance materially increases the risk of accidental disclosure or misuse of regulated personal data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly states that the report contains shipped FBA customer order data including ship-to location, which is customer-related sensitive information. In a skill designed to automate request, download, extraction, and local HTTP serving of Amazon reports, omitting any warning or handling guidance for sensitive data increases the risk of accidental exposure, over-sharing, or insecure downstream use.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This documentation guides retrieval of an all-orders report for a time period but does not warn that such reports can contain sensitive order and potentially customer-related data, which increases the chance of mishandling, over-collection, or unsafe sharing. In this skill's context, the risk is elevated because the broader automation flow downloads, extracts, and then serves files over a local HTTP endpoint for browser access, making accidental exposure of sensitive report contents more likely.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation covers a restricted Amazon VAT transaction report that contains sensitive tax and cross-border transaction data, but it only notes the technical requirement for an RDT and role. Without explicit handling, authorization, and disclosure warnings, downstream users or agent logic may treat the report like ordinary operational data and expose, mishandle, or over-share regulated financial/tax information.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This reference material explicitly covers order, financial, returns, and performance reports that can contain sensitive business data and potentially customer-related information, but it provides no warning about secure handling, least-privilege access, retention, or exposure risks. In the context of this skill, the omission is more concerning because the skill description says downloaded and extracted files are then made available via a local HTTP service for browser download, which increases the chance of accidental disclosure of sensitive report contents.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

1. **读取下列任一路径**（skill 加载路径取决于运行环境；`scripts/check_auth_dependency.py` 会按相同规则自动探测）：
   - 仓库 / 通用扁平目录：`<skills_dir>/linkfox-amazon-store-auth/SKILL.md`
   - Claude：`~/.claude/skills/linkfox-amazon-store-auth/SKILL.md`
   - Cursor：`~/.cursor/skills/...`、`~/.cursor/skills-cursor/...`
   - **OpenClaw**：`<OPENCLAW_WORKSPACE>/skills/...`、`~/.openclaw/skills/...`、`~/.agents/skills/...`（与 [OpenClaw Skills 文档](https://docs.openclaw.ai/tools/skills) 的常见路径一致）
   - **Hermes Agent**：`~/.hermes/skills/<category>/linkfox-amazon-store-auth/SKILL.md`，以及 `~/.hermes/plugins/<plugin>/skills/linkfox-amazon-store-auth/SKILL.md`（与 [Hermes Skills 文档](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills) 的布局一致）

• Confidence: 86% confidence
• Finding: The dependency check instructs the agent to probe a wide set of well-known skill directories across multiple platforms, which amounts to local environment and installation enumeration. Even if intended for compatibility, this reveals filesystem layout and installed tooling presence, increasing host fingerprinting and privacy risk.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- Claude：`~/.claude/skills/linkfox-amazon-store-auth/SKILL.md`
   - Cursor：`~/.cursor/skills/...`、`~/.cursor/skills-cursor/...`
   - **OpenClaw**：`<OPENCLAW_WORKSPACE>/skills/...`、`~/.openclaw/skills/...`、`~/.agents/skills/...`（与 [OpenClaw Skills 文档](https://docs.openclaw.ai/tools/skills) 的常见路径一致）
   - **Hermes Agent**：`~/.hermes/skills/<category>/linkfox-amazon-store-auth/SKILL.md`，以及 `~/.hermes/plugins/<plugin>/skills/linkfox-amazon-store-auth/SKILL.md`（与 [Hermes Skills 文档](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills) 的布局一致）
2. **或直接运行脚本**：`python scripts/check_auth_dependency.py`，脚本会在缺失时以 **exit code `42`** 退出，并在 stderr 输出结构化提示（以 `DEPENDENCY_MISSING:` 开头）。脚本已内置 **OpenClaw / Hermes** 路径判断；若在 Hermes 的 `config.yaml` 里配置了 `skills.external_dirs`，请设置环境变量 `HERMES_SKILLS_EXTERNAL_DIRS`（使用系统路径分隔符串联多个目录）以便探测。
3. 如果上述检查**全部失败**，则判定为 **`linkfox-amazon-store-auth` 未安装**。

• Confidence: 87% confidence
• Finding: The script-based dependency detection further broadens environment probing by using built-in path heuristics and optional environment variables such as HERMES_SKILLS_EXTERNAL_DIRS. This can reveal external directory configuration and installed agent ecosystems, which is unnecessary information exposure if not tightly scoped.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.