Security audit

1688-商品热销榜单

Security checks for vulnerabilities and agentic risk

Overview

This 1688 product-ranking skill mostly matches its stated purpose, but it also includes under-scoped account, billing, credential, storage, and automatic feedback behaviors users should review carefully.

Install only if you are comfortable with LinkFox handling ranking queries, account onboarding, billing actions, feedback reports, and local result files. Use a dedicated, revocable API key; avoid the phone/SMS and payment flows inside the skill when possible; do not store keys in shell startup files; and review or clear generated files under the linkfox data/cache directories.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:185
Finding: Silent Transmission of User Statements and Intent to a Feedback Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/dld_product_billboard.py:36
Finding: Configurable Network Destinations Permit Credential Redirection
Content: View full analysis
str: """Gateway base address: environment override, otherwise production.""" return ( os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com" ).rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding exposes additional configurable destinations: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com", ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` ### Technical Analysis The scripts tru ...[truncated 1727 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:484
Finding: API Key Is Printed to Standard Output and Recommended for Plaintext Persistence
Content: View full analysis
int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} API key obtained successfully " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` The onboarding documentation recommends commands equivalent to: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login result contains the complete API key, and `_emit(r)` serializes the entire result to standard output. In Agent environments, stdout may be captured in transcripts, tool logs, terminal history, observability systems, or support bundles. The documentation further recommends placing the key directly into shell startup files. Such files are long-lived, copied into backups, sourced by every interactive shell, and may have permissions broader than a dedicated secrets store. Exporting the key also makes it available to descendant processes. The combination of Agent-visible output and persistent plaintext storage significantly incr ...[truncated 857 chars]
Remediation: View remediation

other

Warning

Location: scripts/dld_product_billboard.py:60
Finding: Product Requests Include Unnecessary Session and Message Telemetry
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dld_product_billboard.py:87
Finding: Complete Query Responses Are Persistently Stored Without Explicit Access Controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/onboarding.py:163
Finding: Runtime Installation Guidance Uses Unpinned Third-Party Dependencies
Content: View full analysis
dict: try: import qrcode except ImportError: err = "Missing dependency; run: pip install qrcode pillow" print( f"{TAG} render_qr: {err}", file=sys.stderr, ) return { "png_path": None, "ascii_qr": None, "error": err, } def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing dependency; run: pip install requests" ) ``` ### Technical Analysis The Skill directs users to install mutable package names without: - Pinned versions. - Cryptographic hashes. - A lockfile. - An authenticated internal package source. - A documented review baseline. Package installation can execute package build hooks and other installation-time code. Even when the package names are legitimate, unconstrained installation means future or compromised releases can alter the effective code after the Skill has been audited. No evidence was found that the Skill intentionally references a typosquatted package. The risk arises from unsafe and non-reproducible dependency management. ### Attack Path 1. The onboarding command encounters a missing package. 2. The user follows the displayed `pip install` instruction. 3. The package installer resolves the latest available package and dependencies. 4. A compromised package release, dependency, package-index response, or malicious mirror provides attacker-controlled code. 5. Installation or later import executes that code under the user’s account. ### Impact Assessment Dependency code executes with the same local permissions as the user running the Skill. It could read files available to that user, access environment variables cont ...[truncated 171 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/onboarding.py:43
Finding: Onboarding Client Spoofs Browser Headers and Uses a Fixed UID Header
Content: View full analysis
str: parts = (access_token or "").split(".") hdr = _b64url_json(parts[1]) if len(parts) >= 2 else {} raw = json.dumps( { "a_id": hdr.get("a", ""), "d_id": str(user_id), }, separators=(",", ":"), ).encode() return base64.urlsafe_b64encode(raw).decode() ``` ```python def _headers( source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "", ) -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = ( _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ) if group_id: h["tid"] = group_id return h ``` ### Technical Analysis The command-line onboarding client presents itself as a specific Windows Chrome browser and fabricates browser `Origin` and `Referer` headers. When an access token is supplied without a user ID, it sends a hard-coded UID-derived header rather than failing closed. These headers may be required by undocumented internal LinkFox endpoints, but the implementation is not a transpa ...[truncated 1126 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/dld_product_billboard.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The code builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends SMS-login data, access tokens, refresh tokens, and API-token operations to those endpoints with no allowlist or host validation. In a skill environment, env vars are part of the trust boundary; if an attacker or misconfigured host overrides them, sensitive credentials can be exfiltrated to attacker-controlled infrastructure.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The gateway URL is also sourced from environment configuration and used in urlopen with the Authorization header carrying the LinkFox API key. An attacker controlling LINKFOX_AGENT_API_URL or fallback variables could redirect requests and capture the API key or manipulate order/account responses, enabling credential theft and unauthorized billing-related actions.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is passive product-ranking lookup, but the skill also instructs handling login, API key generation, account/team lookup, package purchase, payment initiation, QR-code rendering, and order-status polling. This is a major capability expansion into authentication and billing flows, which can expose users to credential capture, unauthorized purchases, privacy leakage, and unexpected external actions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger logic is intentionally broad and says to activate even when the user does not explicitly mention the billboard feature, as long as the request vaguely relates to sourcing opportunities. Over-broad triggering increases the chance that the skill runs in contexts the user did not intend, which is especially dangerous because the skill also contains onboarding, account, and payment handling instructions.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
{"productIds": "123456、789012"}

text
## Display Rules 1. **Present data clearly**: Show product results in well-organized tables including product title, wholesale price, dropship price, order count, units sold, estimated revenue, supplier name, and listing date 2. **Image display**: When `imageUrl` is available, display product images to help users visually identify products

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions tell the operator to request a user phone number and run registration/login commands on the user’s behalf, which is not justified for a product-ranking lookup skill. This creates unnecessary collection of personal data and enables the skill to mediate account creation and authentication flows, increasing the risk of privacy violations, account abuse, and social-engineering-style credential handling.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation includes plan listing, payment-method selection, order creation, and payment-status querying for billing issues, none of which are necessary for a skill that should only retrieve bestseller-ranking data. This broadens the trust boundary from read-only data access into transaction facilitation, which can expose users to payment manipulation, phishing-like redirection, or unauthorized purchases if the workflow is misused.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module documentation explicitly says writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and temp directory. This mismatch is dangerous because operators may rely on the documented storage guarantees, while the code can still write sensitive API data to less controlled locations, including temporary storage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This skill is described as querying 1688 bestseller rankings, but the file implements a full LinkFox onboarding and monetization CLI: SMS verification, login, API-key issuance, package listing, ordering, and payment QR generation. That mismatch is dangerous because it introduces powerful credential and billing capabilities unrelated to the declared purpose, increasing the chance of covert account takeover, token harvesting, or deceptive user workflows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Order creation, payment URL handling, QR rendering, and order-status querying are materially unrelated to a read/query-style product-ranking skill. In context, these capabilities increase harm because the skill can initiate real billing flows and steer users into payment actions under the guise of sourcing research.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill appears to require environment access, file writing, and network access but does not declare any tool scope or permission boundaries. That creates an authorization gap where a broadly-triggered skill could access sensitive capabilities without transparent user/admin review, especially given the onboarding/payment behavior described later in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The parameter guide states that the product keyword must be in Chinese and instructs the agent to translate first if not. This imposes a specific language behavior rather than offering the user a choice or obtaining opt-in, which is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file instructs the skill to translate any non-Chinese keyword before querying and presents this as mandatory behavior. Because it does not offer a language choice or ask for confirmation before translation, it enforces a locale-specific behavior in violation of the stated policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The parameter description states that search keywords 'must be Chinese' and instructs translation if they are not. This is a natural-language locale restriction, and the file does not provide user opt-in, language alternatives, or a documented justification for why only Chinese is permitted.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 108)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/dld/productBillboard \

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file embeds account-authentication, registration, and billing recovery procedures that are unrelated to a skill whose stated purpose is querying 1688 bestseller/ranking data. This expands the skill’s operational scope into credential handling and account lifecycle actions, creating an unjustified pathway to collect sensitive information and steer users into account/payment flows outside the core use case.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The onboarding flow instructs collection and transmission of a user’s phone number into a script without any visible consent, retention, masking, or privacy-handling guidance. In the context of a sourcing/ranking skill, this data collection is especially unjustified, making the privacy risk more severe because users would not reasonably expect phone-based account processing for this feature.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description suggests a simple query tool, but the script also persistently stores full API responses plus session metadata on disk by default. This creates a confidentiality and data-minimization issue because potentially sensitive business data, identifiers, or tokens in responses may be retained locally without explicit user consent or need.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script forwards SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME from the environment to the remote API without clear disclosure at the call site. These identifiers can expose internal workflow metadata or enable cross-system correlation, especially if the gateway endpoint is changed or logs are broadly accessible.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script always writes the full serialized API response to disk before deciding whether to print inline or summarize. This is risky because API responses may include sensitive commercial data or identifiers, and automatic persistence increases exposure through local compromise, backups, multi-user systems, or accidental sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file presents its top-level description and command help text entirely in Chinese, and there is no visible mechanism for user language selection or opt-in. That can violate language/locale policy when the skill is expected to operate for general users without forcing a single locale.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code performs SMS-based authentication, token exchange, user/team discovery, and API-key generation despite the skill's stated purpose being 1688 product-billboard lookup. In this context, collecting login codes and minting API keys is especially risky because it can be used to obtain durable access credentials far beyond the least privilege needed for rankings data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.