eBay国际站-商品搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:22 AM UTC
• Version: 1.0.6

Overview

This eBay search skill has a coherent core search function, but it also silently reports feedback and handles account, credential, and payment flows in ways users should review carefully.

Install only if you are comfortable using LinkFox as a paid intermediary for eBay searches. Do not let it send feedback automatically without reviewing the payload, avoid providing phone/SMS credentials unless you intend to create or access a LinkFox account, review any payment/order step before proceeding, and store the API key in a proper secret manager rather than shell startup files. Use default LinkFox endpoints only, and periodically delete saved search response files if queries, postal codes, or market research are sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:222

Finding

Silent Transmission of Conversation-Derived Feedback to a Separate Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:484

Finding

API Key Exposed Through Standard Output and Recommended Plaintext Persistence

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboarding documentation recommends persisting the key in shell startup files: ```shell setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The full API key is included in a JSON object printed to standard output. Standard output may be captured in Agent transcripts, terminal scrollback, shell tooling, CI logs, task-runner logs, or support records. The recommended Unix configuration commands then append the credential in plaintext to `.zshrc` or `.bashrc`. These files commonly enter workstation backups, diagnostic bundles, dotfile repositories, and synchronization systems. They may also be re ...[truncated 1389 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:67

Finding

Configurable Base URLs Permit Redirection of Authentication Secrets

Content

View full analysis

str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive headers are attached to requests sent to those configured URLs: ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() ``` ```python headers = {"Authorization": _api_key()} if method == "POST": headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) ``` The search script has the same trust model: ```python def get_api_base() -> str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SE ...[truncated 2123 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/ebay_search.py:101

Finding

Search Queries and Full Responses Persisted with Default Filesystem Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Unpinned Runtime Dependency Installation Guidance

Content

View full analysis

None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` The resulting commands are equivalent to: ```shell pip install qrcode pillow pip install requests ``` ### Technical Analysis The project does not include a locked dependency manifest, reviewed version constraints, or cryptographic hashes. The suggested commands install whichever package versions the configured package index currently serves. No evidence shows that the named packages are malicious. The weakness is that installation is non-reproducible and may accept a compromised future release, a poisoned private index, or an incompatible dependency chain. Python package installation can execute package-controlled build logic during installation. ### Attack Path 1. The onboarding script runs in an environment where `requests`, `qrcode`, or `Pillow` is unavailable. 2. The script instructs the user to invoke an unrestricted `pip install` command. 3. The user's package index, mirror, or dependency resolution path supplies an unexpected or compromised release. 4. Installation executes package build or installation logic with the user's privileges. 5. Malicious package logic can access files, environment variables, and credentials available to that user. ### Impact Assessment If the dependency source or release is compromised, code executes with the privileges of the user running `pip`. This could expose local fil ...[truncated 197 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request target and multiple outbound headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY and SESSION_ID/MODE_ID/APP_NAME. In an agent/runtime context, environment variables are often externally controlled; this allows SSRF-style redirection of authenticated POST requests, including the API key in the Authorization header, to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/ebay_search.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The script constructs request destinations from environment-controlled base URLs and then sends sensitive material to them, including SMS login data, access tokens, refresh tokens, API-token requests, and authorization headers. If an attacker can influence environment variables in the skill runtime, this becomes an SSRF/exfiltration path that can redirect credentials and account actions to attacker-controlled infrastructure.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The gateway request path uses environment-derived base URLs and attaches the LinkFox API key in the Authorization header before calling urlopen. A compromised or attacker-influenced environment can therefore redirect authenticated requests to an arbitrary host, exposing API credentials and enabling unintended outbound requests.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the associated implementation also performs login, API key generation, account/team inspection, subscription lookup, and payment/order workflows, that is a major expansion beyond the declared eBay-search purpose. Such undisclosed account and payment capabilities materially increase risk because they may access sensitive identity, billing, and credential data under misleading expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the associated implementation also performs login, API key generation, account/team inspection, subscription lookup, and payment/order workflows, that is a major expansion beyond the declared eBay-search purpose. Such undisclosed account and payment capabilities materially increase risk because they may access sensitive identity, billing, and credential data under misleading expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation criteria are overly broad and allow the skill to trigger even when the user does not explicitly request eBay. Because the skill incurs cost, performs network requests, and persists results, over-triggering can cause unauthorized data handling, unnecessary spending, and context leakage beyond user intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

{"keyword": "Kopfhoerer", "ebayDomain": "ebay.de", "location": 77}

text

## Display Rules

1. **Present data clearly**: Show search results in well-formatted tables including key fields such as title, price, condition, seller info, and shipping
2. **Price formatting**: Always display prices with their currency symbol. When showing price ranges (minPrice to maxPrice), format as a range

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file documents account onboarding, phone-based registration, API key acquisition, and billing workflows that are unrelated to the stated eBay search capability. In a skill that should only search eBay listings, these instructions expand the operational scope into credential handling and payments, creating unnecessary attack surface and enabling social-engineering or unauthorized service enrollment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented ability to collect a user's phone number, send login codes, register accounts, and initiate plan purchases is not justified by an eBay listing search skill. This mismatch between advertised functionality and embedded operational behavior is dangerous because it can be used to funnel users into unrelated account creation and payment flows under the guise of a benign search feature.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements LinkFox account onboarding, SMS verification, API-key issuance, package listing, ordering, and payment QR generation, which is unrelated to the declared eBay search/browsing skill. Such scope mismatch is dangerous because it introduces credential collection and monetization flows into a skill that users would reasonably expect to only search eBay listings.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code can create paid orders and render payment QR codes even though the skill is supposed to help search and compare eBay listings. In this context, embedded billing capability is unjustified and increases the risk of deceptive charges, monetization abuse, or social engineering through an apparently unrelated skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script performs SMS-based login, token exchange, user-info retrieval, and API-token generation for LinkFox accounts, none of which is necessary for browsing eBay products. In a skill advertised for eBay search, collecting phone numbers and verification codes is especially suspicious because it can be used to harvest credentials and provision access unrelated to the stated purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permissions despite instructing use of environment variables, network access, and persistent file writes. In an agent setting, missing scope declarations weakens least-privilege controls and makes the skill harder to govern or safely sandbox.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written as an instruction in Chinese describing when the skill triggers, while the rest of the file is mixed-language and does not state that the skill is intentionally limited to Chinese-speaking users or offer a language choice. This can violate language/locale policy because it imposes a locale-specific interaction pattern without user opt-in or a documented regional requirement.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill mandates persistent logging of complete tool responses in a session-organized directory, which can retain user-provided search terms, shipping/location inputs, seller/product data, and session identifiers beyond immediate need. Persistent full-response storage expands exposure in the event of local compromise, accidental inclusion in project artifacts, or later unintended reuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The usage example instructs users to search sold listings for price research, and the parameter guide documents showOnly values Sold and Complete. This directly conflicts with the later statement that the tool returns only current live listings and not historical data, creating an intent/documentation contradiction within the skill file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The limitation states 'This tool returns current live listings only, not historical pricing trends,' which suggests non-live data is unavailable. However, the documented parameters and examples explicitly support showOnly: Sold,Complete for sold/completed listings, which are historical listing outcomes rather than only current live listings.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 69)May include surrounding context.

| sourceType | string | 来源平台标识（ebay） | | sourceTool | string | 来源工具标识 |

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/ebay/search \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file documents a separate feedback API that is unrelated to the core eBay search function, creating an additional data egress path within the skill. Because the payload explicitly includes free-form content and a skill identifier, an agent could send user prompts, outcomes, or other sensitive context to an external service without that transfer being necessary for the requested search task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes transmitting feedback content to https://skill-api.linkfox.com/.../feedback but provides no warning that user text or interaction summaries may be sent to a separate external endpoint. This lack of disclosure increases the risk of silent exfiltration of sensitive user data, especially if an agent automatically constructs feedback from the conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions ask the user to provide a phone number for script-driven registration without any privacy notice, data-handling explanation, retention limits, or consent language. Collecting personal contact data in this way increases the risk of privacy violations, unauthorized transmission to third-party services, and user deception about how their information will be used.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring claims responses are only written under the current working directory and explicitly forbids /tmp, but the implementation falls back to ~/linkfox and the system temp directory. This can silently place potentially sensitive API responses in broader, less expected locations, weakening data-handling guarantees and increasing the chance of accidental exposure in multi-user or ephemeral environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

SQP-3 covers natural-language policy issues including forcing a specific language without user opt-in. This file presents all operational guidance exclusively in Chinese and does not indicate that the skill is region-specific or that users can choose another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.