亚马逊-店铺上传

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.7

Overview

This upload skill has a coherent Amazon upload purpose, but it also includes high-impact LinkFox login, API-key, billing, payment, endpoint-override, and durable response-logging behavior that users should review before installing.

Install only if you trust LinkFox with the Amazon upload workflow and are comfortable with the skill helping users create or retrieve LinkFox API keys, handle SMS login, and initiate payment orders when billing errors occur. Treat API keys, phone numbers, upload URLs, and saved linkfox response files as sensitive; review endpoint-related environment variables before use and clean stored response files when they are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST target URL is ultimately derived from environment-controlled base URLs, and this function sends authentication-bearing requests including access tokens, uid/tid headers, and login data. In a skill context, allowing runtime override of service endpoints can redirect secrets and user data to attacker-controlled infrastructure, effectively turning the CLI into an exfiltration proxy.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request URL is built from environment-derived base configuration and used with an Authorization header containing the LinkFox API key. An attacker who can influence environment variables can redirect these calls to a malicious server and capture the API key or manipulate package/order operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents capabilities to read environment variables, read and write local files, invoke shell scripts, and make network requests, but it does not declare permissions or present a clear capability boundary. This increases the risk of over-privileged execution and makes it harder for users or a platform to understand that the skill can access sensitive local state and transmit files externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is Amazon file upload, but the behavior reportedly also includes SMS-code login, API key generation/retrieval, account/package lookup, order creation, payment QR generation, payment-status polling, and local persistence of results. That mismatch is dangerous because it expands the trust boundary into authentication and billing workflows users did not ask for, enabling unexpected credential handling, account actions, or charges.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The shared helper persistently writes full API responses to local disk under predictable workspace/home/temp locations, even though the skill is described as an upload helper. Upload-related API responses can contain pre-signed URLs, resource metadata, seller identifiers, or other sensitive operational data that then remain on disk beyond the immediate task and may be accessible to other local processes or later sessions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key retrieval, plan listing, ordering, and payment QR handling, which are unrelated to the declared Amazon upload function of the skill. Such scope mismatch is dangerous because it can trick users into performing credential and payment flows under the guise of a benign upload utility.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code contains order creation, payment method handling, and payment QR generation despite the skill being described as an Amazon file-upload helper. Embedding commerce actions in an unrelated skill creates a strong risk of deceptive charges, abuse of user trust, and unauthorized monetization workflows.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The module performs phone-based authentication, token exchange, team discovery, and API-token generation for LinkFox services, none of which are necessary for uploading files to Amazon SP-API. In this context, collecting login codes and minting API keys is especially dangerous because users may disclose credentials believing they are authorizing only an Amazon upload operation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module self-identifies as a LinkFox onboarding CLI rather than an Amazon upload implementation, directly contradicting the skill metadata. This mismatch is a strong indicator of deceptive packaging and increases the likelihood that users or reviewers will misunderstand the code's true behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states it will always write full responses into a session directory under the current working directory, with no opt-in and no strong warning that local project files will be modified. Automatic writes can leak sensitive API responses, create unwanted artifacts in source trees, and expose session data to other tools or commits.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill says uploads are performed directly to a returned URL and explicitly bypass the gateway, but it does not prominently warn users that file contents will be sent to an external presigned endpoint. Direct external upload widens exfiltration risk because the destination is dynamically provided and may not be subject to the same controls, logging, or validation as gateway traffic.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly documents uploading binary files to a returned external URL, but it provides no warning about the privacy, sensitivity, or trust implications of sending user-supplied content to a presigned destination outside the main SP-API proxy flow. In a file-upload skill, this omission is security-relevant because users or calling agents may transmit sensitive documents, images, or attachments without understanding that the data leaves the primary API boundary and may be exposed if the destination URL, headers, or file contents are mishandled.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions direct the operator to collect a user's phone number and use it in a scripted registration/login flow, but provide no privacy notice, consent language, retention limits, or safe-handling guidance for this personal data. In a support/onboarding context, this creates unnecessary privacy and compliance risk because operators may solicit and process sensitive contact data without informing users how it will be used or protected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: API responses are saved to disk without clear user-facing warning or consent. Because this is a store-upload skill interacting with SP-API and developer proxy endpoints, the stored data may include operationally sensitive response bodies, signed upload targets, seller context, or error payloads that were not intended for durable retention.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The login command returns the generated API key in stdout JSON, which may be captured by logs, shell history pipelines, orchestrators, or calling agents. Because this key grants access to LinkFox APIs, exposing it through normal command output materially increases credential leakage risk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The helper's documented behavior explicitly saves complete responses to disk and summarizes large responses to stdout, increasing both retention and exposure of returned data. In an upload skill, such returned data can include pre-signed upload destinations, request metadata, IDs, and error details that should be treated as sensitive and ephemeral; persisting and summarizing them broadens the disclosure surface.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 86% confidence
• Finding: This code transmits data externally via HTTP POST, including login information and tokens, which is security-relevant in a skill that is supposed to handle Amazon uploads rather than LinkFox onboarding. External transmission is expected for network clients, but in this mismatched context it amplifies the risk of credential collection and off-platform data flow.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.