1688-商品热销榜单

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.7

Overview

The skill can query 1688 rankings, but it also includes sensitive login, API-key, billing/payment, and automatic feedback flows that are broader than a user would reasonably expect from a product-ranking skill.

Review carefully before installing. Use the ranking query only if you are comfortable with LinkFox network calls, local result caching, API-key use, and paid credit consumption. Prefer obtaining and storing API keys through LinkFox's official site yourself; avoid giving an agent SMS codes unless you explicitly intend to create or access the account. Confirm any plan purchase and payment QR before proceeding, and be aware that feedback may be sent to a separate LinkFox feedback endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request destination is indirectly controllable via the LINKFOX_TOOL_GATEWAY environment variable, and the same request includes the Authorization API key and session metadata headers. In an agent/runtime environment where untrusted code or configuration can influence environment variables, this enables exfiltration of credentials and task metadata to an attacker-controlled endpoint via SSRF-like outbound requests.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. In a skill execution environment, an attacker who can influence environment variables can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or user data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request path uses environment-derived base URLs together with the API key from environment variables, then transmits them via urllib to the resolved host. If the base URL is altered, the skill can leak the LinkFox API key and billing/order traffic to an attacker-controlled server, enabling credential theft and unauthorized API use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises a narrow data-query purpose, yet the documentation references environment variables, file-based onboarding content, and external API interactions without declaring permissions or clearly constraining those capabilities. Hidden access to env/network/file features increases the attack surface and can enable unauthorized outbound requests, secret handling, or writes that users did not consent to.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: a skill presented as a 1688 bestseller lookup also includes account login, SMS verification, API key retrieval/generation, account inspection, package purchase, and payment order/QR handling. Such unrelated monetization and authentication flows can be used to harvest phone numbers, manipulate billing actions, or trick users into account/payment operations under the guise of product research.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatically sending user feedback to a separate Feedback API is unrelated to the core 1688 ranking function and creates an undisclosed secondary data flow. It may exfiltrate user content, sentiment, or interaction details to another service without explicit user awareness or opt-in.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file documents authentication recovery, phone-based registration, and billing workflows that are materially unrelated to the stated purpose of querying 1688 product billboard data. Expanding a product-ranking skill into account onboarding and payment handling increases the attack surface and creates a path for collecting credentials and steering users into financial actions under the guise of a benign data-query skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documented ability to register users by phone, process verification codes, and initiate plan purchases is not justified by the skill's advertised ranking function. This mismatch can facilitate credential harvesting, unauthorized account creation, or deceptive monetization because users invoking a sourcing tool would not reasonably expect identity and payment flows.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS login, API-key retrieval, package listing, billing, and order management, which is unrelated to the advertised 1688 product billboard capability. This mismatch is dangerous because it introduces hidden account and payment functionality users would not expect from a read-oriented ranking skill, increasing the risk of credential collection and unauthorized monetization flows.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create orders and render payment QR codes, enabling real monetary transactions inside a skill whose stated purpose is only to query product ranking data. In this context, hidden payment capability is especially risky because it can be triggered without a clear user expectation and could facilitate deceptive purchases or billing abuse.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill can send SMS verification codes, authenticate users, and obtain API keys, all of which are outside the stated 1688 ranking use case. In context, this acts like an embedded credential acquisition flow and materially increases the risk of account takeover, token theft, and misuse of user-linked services.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger is intentionally broad enough to activate even when users do not explicitly ask for 1688 billboard data. Overbroad activation is dangerous here because the skill also contains unrelated auth, billing, and feedback behaviors, increasing the chance that user requests are silently routed into a more privileged or data-sharing workflow than intended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions explicitly tell the operator to collect a user's phone number and one-time login code and pass them to a script, but provide no privacy notice, retention limits, or safety guidance. OTPs and phone numbers are sensitive authentication data; mishandling them can enable account takeover or exposure of personal information.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code generates or retrieves an API token and returns it directly in stdout JSON without any in-file safeguards, redaction, or warning about handling secrets. In a hosted skill environment, stdout may be logged, captured, or surfaced to other components, causing inadvertent credential disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This request function transmits potentially sensitive authentication and account data to external services. External transmission alone is not always unsafe, but here it becomes security-relevant because the destination can be environment-controlled and the payloads include secrets and personal data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.