eBay国际站-商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.6

Overview

This skill can search eBay, but it also handles phone-based account setup, API keys, paid-plan ordering, feedback reporting, and persistent local storage in ways that deserve careful review.

Install only if you are comfortable with LinkFox handling your eBay search queries, session metadata, feedback content, phone-based account onboarding, API keys, and paid credit workflows. Avoid using it in sensitive workspaces unless you control the environment variables and understand where the local linkfox output files may be written.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in HTTP headers, most importantly the API key in the Authorization header and session metadata fields. Because the destination host is also configurable through LINKFOX_TOOL_GATEWAY, an attacker who can influence environment variables can redirect authenticated requests and exfiltrate credentials or sensitive session context to an arbitrary server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill document instructs use of environment variables, network access, and persistent file writes, yet no explicit permission declaration is present. This creates hidden capability risk: an operator or orchestrator may invoke a skill that can access secrets, call external services, and write data to the workspace without users understanding the trust boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented skill purpose is eBay search, but the referenced onboarding/payment flow introduces unrelated account login, API key generation, package lookup, order creation, QR code generation, and payment-status polling. A skill that can pivot from product search into account authentication and payment operations materially expands the attack surface and can socially engineer users into credential submission or unintended purchases.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file documents a separate feedback submission endpoint unrelated to the core eBay search function, expanding the skill's effective capabilities beyond its stated purpose. In an agent setting, this can enable unexpected outbound data transmission of user content or interaction summaries to a third-party service, creating a privacy and data-governance risk even if framed as benign telemetry.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The onboarding document introduces authentication, account registration, and billing workflows that are not necessary for an eBay search/browsing skill. This expands the skill's effective privileges and user interaction scope into credential handling and monetization flows, creating opportunities for phishing, unauthorized data collection, and deceptive payment prompting.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The document explicitly instructs the agent to ask for a user's phone number, trigger registration, and guide plan purchase, none of which are justified by a product-search skill. In context, this is dangerous because it turns a low-risk search capability into a conduit for sensitive data collection and payment redirection, which could be abused for fraud or social engineering.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The documentation promises that output is written only under the current working directory and forbids /tmp, but the implementation may fall back to ~/linkfox or the system temp directory. This mismatch can cause sensitive API responses to be stored in less controlled locations than operators expect, increasing the chance of disclosure on shared systems or through weaker filesystem protections.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The script claims /tmp is prohibited and that failure to write to the current directory should error out, yet _linkfox_root silently selects alternate locations including the temp directory. This creates a deceptive security boundary where users may rely on locality and retention assumptions that are not actually enforced, leading to unintended persistence or leakage of search results and metadata.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements SMS login, token acquisition, team/user discovery, API-key generation, package listing, ordering, and payment QR creation, none of which are necessary for an eBay search skill. The mismatch between declared purpose and implemented capability is dangerous because it enables credential collection and account monetization flows under the cover of an unrelated shopping-search skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders, determine user/team status, and render payment QR codes for subscription purchase, which is unjustified for an eBay listing search capability. In skill context this is more dangerous because users invoking product search would not reasonably expect the skill to initiate purchase flows tied to an external service.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill reads API credentials from environment variables, decodes JWT content, and builds identifiers used to generate or retrieve fresh API tokens. For an eBay search skill, harvesting platform credentials and provisioning additional tokens is unrelated and materially increases the risk of unauthorized account access or lateral use of privileged secrets.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger scope is intentionally broad enough to activate even when the user does not mention eBay, which increases the chance of unintended invocation for generic shopping, pricing, or market-analysis requests. In this skill's context, each invocation may consume paid credits and may perform external requests and local writes, so overbroad activation can cause unwanted cost, privacy exposure, and action on behalf of the user without clear intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions tell the agent to request and transmit a phone number for registration without any privacy notice, purpose limitation, retention guidance, or explicit consent flow. That creates unnecessary exposure of personal data and increases the risk of mishandling sensitive user information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The login command emits a newly obtained API key in stdout JSON, which is likely to be captured by logs, transcripts, orchestration layers, or other tools. Exposing freshly minted credentials this way can lead to secret leakage and subsequent unauthorized API use.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 90% confidence
• Finding: This duplicate finding references the alternate environment variable name, but the same concern applies: the skill harvests host secrets for unrelated onboarding and account-management activity. In the context of a search skill, consuming such credentials expands trust boundaries and can enable unintended privileged actions.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 90% confidence
• Finding: This duplicate finding references the alternate environment variable name, but the same concern applies: the skill harvests host secrets for unrelated onboarding and account-management activity. In the context of a search skill, consuming such credentials expands trust boundaries and can enable unintended privileged actions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.