Linkfox 电商合规检测

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:52 PM UTC
• Version: 1.2.3

Overview

The skill mostly matches its LinkFox compliance-checking purpose, but it needs Review because it sends credentials to environment-selected endpoints and may save full results outside the location it promises.

Install only if you trust the runtime environment and LinkFox account flow. Do not set LINKFOX_TOOL_GATEWAY, LINKFOX_AGENT_API_URL, LINKFOX_LOGIN_API_URL, or LINKFOX_AGENT_USER_API_URL unless they point to trusted LinkFox endpoints, and review or clean the generated linkfox output/cache directories after sensitive checks.

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (73)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is ultimately derived from environment-controlled base URLs, and this helper sends sensitive authentication material such as access tokens, refresh tokens, API tokens, phone numbers, and SMS codes to that destination. In a skill/runtime environment where environment variables can be influenced by a host, wrapper, or attacker, this becomes an SSRF/exfiltration path that can redirect credential-bearing requests to an attacker-controlled server.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request target is also built from an environment-derived base URL and is used with the Authorization header populated from the local API key. An attacker who can influence the environment can cause authenticated requests to be sent to an arbitrary host, leaking the API key and enabling unauthorized actions or internal network probing.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The script forwards multiple environment-derived values to a remote service in HTTP headers, including SESSION_ID, MODE_ID, APP_NAME, and an API key. Because the destination host can be overridden via LINKFOX_TOOL_GATEWAY, an attacker controlling the environment or execution context can redirect requests and exfiltrate these secrets/metadata to an arbitrary server.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request sent to urlopen includes multiple headers sourced directly from environment variables, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration path for sensitive runtime data, including the API key and session metadata, to an attacker-controlled endpoint if the environment is poisoned or untrusted.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request sent via urlopen includes attacker-influenced environment data in headers, most importantly the Authorization API key and a gateway URL that can be overridden by LINKFOX_TOOL_GATEWAY. If an attacker can control the environment, they can redirect the POST to an arbitrary host and exfiltrate the API key plus request data; this skill context makes the issue more dangerous because the script is explicitly designed to call a remote service with privileged credentials.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in HTTP headers, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path for sensitive session metadata and the API key to an attacker-controlled endpoint if the environment is influenced by an untrusted workspace, wrapper, or runtime.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes multiple attacker-influenced environment values, most importantly LINKFOX_TOOL_GATEWAY for the destination and SESSION_ID/MODE_ID/APP_NAME as outbound headers. This creates a real data exfiltration risk because a modified environment can redirect traffic to an untrusted host and cause the API key and request payload to be transmitted there.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes headers populated directly from environment variables, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. This allows sensitive session metadata and the API key to be transmitted to an attacker-controlled endpoint if the environment is influenced, creating a real exfiltration risk in agent/runtime contexts.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request sent to the network includes headers derived from environment variables, notably the API key and session metadata, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. That means anyone who can influence the environment can redirect authenticated traffic, causing credential exfiltration and leakage of request/response data to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes sensitive headers populated from environment variables, including the API key and session metadata. Because the destination base URL is overrideable through LINKFOX_TOOL_GATEWAY, an attacker who can influence the environment can redirect the request to an arbitrary host and exfiltrate credentials and task context.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request URL is derived from get_api_base(), which trusts the LINKFOX_TOOL_GATEWAY environment variable, and the request also forwards sensitive headers including the API key and session metadata. If an attacker can influence the environment, they can redirect the POST to an attacker-controlled host and exfiltrate credentials and request data via urlopen.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple values taken directly from environment variables, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. In an agent/runtime context, this can expose sensitive session metadata and the API key to an attacker-controlled endpoint if the environment is poisoned or the skill is executed in an untrusted workspace/orchestrator.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 97% confidence
• Finding: The request sent via urlopen includes attacker-influenced destination data because LINKFOX_TOOL_GATEWAY is taken directly from the environment and concatenated into the API URL, while sensitive headers such as the API key are attached to the same request. In an agent or CI environment where env vars can be influenced, this can redirect traffic and exfiltrate credentials and patent-query data to an arbitrary host.

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request URL and outbound headers are influenced by environment variables, including LINKFOX_TOOL_GATEWAY and session metadata, and the code sends them directly via urlopen. In an agent/runtime context, a malicious or compromised environment can redirect requests to an attacker-controlled host and exfiltrate the API key plus user-supplied patent search content.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes headers and destination components derived from environment variables, notably LINKFOX_TOOL_GATEWAY and several session-identifying values. In an agent/runtime context, environment variables are untrusted input; if an attacker can influence the gateway URL, the skill may exfiltrate the API key and request data to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes sensitive environment-derived values in headers, including the API key and session metadata, and the destination URL is partially controlled by the LINKFOX_TOOL_GATEWAY environment variable. If that environment variable is poisoned or the runtime is untrusted, the skill can exfiltrate credentials and session identifiers to an attacker-controlled endpoint. In an agent setting, forwarding ambient credentials to a network target based on environment state is a real secret-exfiltration risk.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure should occur if the current directory is not writable, but the implementation falls back to home and temp directories. This mismatch can cause sensitive API responses to be written to locations users or reviewers would not expect, weakening data-handling assurances and potentially exposing cached or saved results on shared systems.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module documentation promises not to write to /tmp and to fail if the current directory is not writable, but the implementation silently falls back to home and temp directories. In a security-sensitive agent context, this can cause sensitive API responses to be persisted in less-controlled locations than operators expect, increasing exposure and breaking data-handling guarantees.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The docstring promises that data will never be written to /tmp and that the script will fail if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This mismatch is security-relevant because users may provide sensitive trademark query data under false assumptions about where it will persist, leading to unintended disclosure on shared systems.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring promises that output will be written only under the current working directory and explicitly forbids /tmp, but the implementation falls back to ~/linkfox and then the system temp directory. This mismatch can cause sensitive API responses to be stored in less expected or less controlled locations, undermining operator trust and data-handling assumptions.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring promises that data will only be written under the current working directory and explicitly forbids using /tmp, but the implementation falls back to ~/linkfox and the system temp directory. That mismatch can cause sensitive API responses to be persisted in locations the user did not expect, weakening data handling guarantees and potentially exposing data to other local users or cleanup processes.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The docstring promises that output will stay under the current working directory and forbids /tmp, but the implementation falls back to the home directory and temp directory. In an agent setting, that mismatch is security-relevant because users and reviewers may rely on the stated storage boundary while the code persists API responses in broader or less controlled locations, increasing the risk of unintended disclosure.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure should occur if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This mismatch is security-relevant because operators may rely on the documented storage guarantees, while sensitive API responses can instead be written to less controlled locations such as shared temp storage.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation falls back to home and temporary directories. This can silently place full API responses into less controlled locations, increasing the risk of unintended disclosure of potentially sensitive data.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that a non-writable current directory should cause an error, but the implementation silently falls back to ~/linkfox and the system temp directory. This mismatch can cause sensitive patent-description API responses to be written to unintended, potentially less protected locations, undermining operator expectations and data-handling policy.

Static analysis

No suspicious patterns detected.