ClawHub
Back to skill

Security audit

Linkfox 电商合规检测

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core LinkFox compliance API use is coherent, but it has review-worthy risks around credential-bearing requests, mutable remote installation instructions, host-identity attribution, and local persistence of sensitive results.

Install only if you trust LinkFox and are comfortable sending product images, descriptions, patent queries, phone/SMS login data, and API credentials to its services. Do not set custom LINKFOX_TOOL_GATEWAY or related endpoint variables unless you control and trust the destination. Avoid following the remote release.zip install fallback without a pinned version and checksum, and keep the linkfox output/cache directory out of shared workspaces because it stores full responses.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:222
Finding

Unconditional Agent Identity and Channel Override

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
references/linkfox-ruiguan-copyright-detection.md:122
Finding

Remote Skill Package Installation Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/onboarding.py:68
Finding

Configurable Network Destinations Receive Authentication Secrets Without Validation

Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` The selected destinations later receive sensitive values: ```python r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) ``` ```python resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) ``` The same pattern affects ordinary API scripts through `LINKFOX_TOOL_GATEWAY`, including the representative implementation in `scripts/zhihuiya_cited_references.py:36-79`, and affects `scripts/upload_image.py:20-69`. ### Technical Analysis The destination URLs are taken directly from environment variables without validating: - The URL scheme. - The destination hostname. - The effective port. - Whether credentials are permitted for that destination. - Whether a redirect changes the credential recipient. The selected endpoints receive LinkFox API keys, access tokens, refresh tokens, phone numbers, SMS verification codes, session identifiers, and user query data. Environment configuration is ...[truncated 1568 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zhihuiya_cited_references.py:250
Finding

Path Traversal Through Unsanitized Session Identifier

Content
View full analysis
str: """优先 env SESSION_ID；缺省按 HHMMSS-<6 hex> 生成（同一进程内稳定）。""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """返回 (linkfox_root, session_dir)；session_dir 一定存在。""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) ``` Equivalent session-directory logic is duplicated across the query scripts. A related implementation exists in `scripts/onboarding.py:153-158`. ### Technical Analysis `SESSION_ID` is treated as a trusted path component. It is not restricted to a safe identifier format and is not checked for: - Absolute paths. - `..` traversal components. - Forward or backward path separators. - Platform-specific drive or UNC path syntax. - Resolution outside the selected `linkfox` root. Because `os.path.join` and `os.makedirs` operate on the resulting path, a malicious session identifier can escape the intended date and session directory. Subsequent code writes `_meta.json`, response JSON files, index data, or QR images beneath the attacker-selected location. The attack requires control over the process environment or another mechanism that determines `SESSION_ID`. ### Attack Path 1. An attacker or untrusted host configuration sets `SESSION_ID` to a traversal value such as `../../target-directory`. 2. `_session_id` returns the value unchanged. 3. `_ensu ...[truncated 1055 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/zhihuiya_cited_references.py:95
Finding

Sensitive API Responses Persisted Without Restrictive Permissions or Cleanup

Content
View full analysis
CACHE_TTL_SEC: return None try: with open(path, encoding="utf-8") as f: payload = json.load(f) if isinstance(payload, dict): payload.setdefault("_cache", {})["hit"] = True return payload except (OSError, json.JSONDecodeError): return None def _save_cache(path, payload): try: with open(path, "w", encoding="utf-8") as f: json.dump(payload, f, ensure_ascii=False, indent=2) except OSError: pass ``` The complete response is also written to a session output file: ```python with open(out_path, "w") as f: f.write(serialized) ``` This storage pattern is duplicated across the API query scripts. ### Technical Analysis The scripts intentionally store full API responses in a cache and in per-session output files. Files and directories are created with default process permissions rather than explicit owner-only modes. Their effective accessibility therefore depends on the runtime umask and parent-directory permissions. The 24-hour cache TTL controls reuse but does not delete expired cache files. The session output files have no automatic retention limit. As a result, query results can remain on disk indefinitely. Although much patent data may be public, the stored material can reveal confidential product descriptions, planned listings, image URLs, internal search activity, legal-risk inves ...[truncated 1070 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/onboarding.py:162
Finding

Unpinned Runtime Dependency Installation Instructions

Content
View full analysis
dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` English translation of the installation messages: “Missing dependency; run `pip install qrcode pillow`” and “Missing dependency; run `pip install requests`.” ### Technical Analysis The onboarding script instructs users to install `qrcode`, `pillow`, and `requests` without: - Exact version pins. - Package hashes. - A lock file. - A constrained package index. - Signature or provenance verification. - Isolation in a dedicated virtual environment. The package names are legitimate and no typosquatting was observed. Nevertheless, floating installation instructions allow the effective dependency set to change after the Skill is reviewed. They can also install incompatible future versions or packages obtained from an untrusted index configured in the user’s environment. ### Attack Path 1. The onboarding script encounters a missing Python module. 2. It instructs the user to execute an unconstrained `pip install` command. 3. The user’s package index, mirror configuration, DNS path, publication account, or dependency release is compromised. 4. `pip` downloads and installs an unexpected or malicious package version. 5. The package executes installation-time behavior or malicious runtime code when imported. 6. The code runs with the privileges of the Python environment used for onboarding. ### Impact Assessment A compromis ...[truncated 358 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (160)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The script builds request destinations from environment-controlled base URLs and then sends sensitive material to them, including phone numbers, SMS codes, access tokens, refresh tokens, and API keys during login and token-generation flows. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, the CLI can be redirected to an attacker-controlled server, causing credential exfiltration and full account/API-key compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The gateway request uses a URL derived from environment-controlled configuration and attaches the Authorization header from LINKFOX_AGENT_API_KEY before calling urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related fallback variables can redirect these authenticated requests to an arbitrary endpoint and capture the API key or induce privileged actions against a rogue service.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The request sent via urlopen includes environment-derived values in headers, and the destination host is also overrideable through LINKFOX_TOOL_GATEWAY. This creates a real exfiltration path: a user or prior tool can point the script at an arbitrary server and cause SESSION_ID, MODE_ID, APP_NAME, the API key, and request payload data to be transmitted externally.

Content

Scanner excerpt · scripts/ruiguan_copyright_detection.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

The request includes multiple headers sourced directly from environment variables, and the destination base URL is also overridable via LINKFOX_TOOL_GATEWAY. In an agent/runtime context, attacker-controlled environment variables can redirect requests and exfiltrate sensitive API keys and session metadata to an arbitrary endpoint, making this a real SSRF/credential-leak style issue.

Content

Scanner excerpt · scripts/ruiguan_detection_patent_design.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The request sent to urlopen includes environment-derived values in headers, and the destination host is also configurable via LINKFOX_TOOL_GATEWAY. This means secrets and identifiers such as the API key, SESSION_ID, MODE_ID, and APP_NAME can be exfiltrated to an attacker-controlled endpoint if the environment is manipulated, which is especially risky in agent/runtime environments where environment variables may be influenced externally.

Content

Scanner excerpt · scripts/ruiguan_text_trademark_detection.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The request sent to urlopen includes headers derived directly from environment variables, and the destination base URL is also overrideable via LINKFOX_TOOL_GATEWAY. In an agent/runtime context, environment variables are often externally influenced, so this can exfiltrate API credentials and session metadata to an attacker-controlled endpoint via SSRF-style redirection.

Content

Scanner excerpt · scripts/ruiguan_trademark_graphic_detection.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 69)May include surrounding context.

python
)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The code uploads the entire local file to a presigned_url returned by a prior network call, without validating the destination host or scheme. If the gateway is compromised or LINKFOX_TOOL_GATEWAY is redirected to an attacker-controlled service, it can return a malicious upload URL and cause exfiltration of arbitrary local image files to an untrusted endpoint.

Content

Scanner excerpt · scripts/upload_image.py (reported line 102)May include surrounding context.

python
)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The request sent to the network includes multiple headers populated directly from environment variables, and the destination base URL is also overridable via LINKFOX_TOOL_GATEWAY. In this skill context, that means secrets and session metadata can be exfiltrated to an attacker-controlled endpoint if the environment is influenced by untrusted input or a compromised runtime, making this a real SSRF/credential-leak style issue.

Content

Scanner excerpt · scripts/zhihuiya_abstract_image.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request headers include multiple environment-derived values, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration/SSRF-style risk in agent environments: secrets and session metadata can be transmitted to an attacker-controlled endpoint simply by setting environment variables, which is especially dangerous because the Authorization API key is always sent.

Content

Scanner excerpt · scripts/zhihuiya_cited_by.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The request sent via urlopen includes multiple headers sourced directly from environment variables, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. In an agent/runtime context where environment variables may be influenced by upstream orchestration or untrusted skill execution context, this can exfiltrate API credentials and session metadata to an attacker-controlled endpoint, making the tainted network flow a real SSRF/data-exfiltration issue.

Content

Scanner excerpt · scripts/zhihuiya_cited_references.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
97% confidence
Finding

The request sent to the network includes header values taken directly from environment variables, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. In an agent/runtime setting, environment variables are part of the trust boundary, so this permits exfiltration of sensitive session metadata and the API key to an attacker-controlled endpoint if the gateway variable is poisoned.

Content

Scanner excerpt · scripts/zhihuiya_claim_translated.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The request URL is derived from an environment-controlled base URL via LINKFOX_TOOL_GATEWAY, and the code sends the API key in the Authorization header to whatever host that variable points to. In an agent/runtime context where environment variables may be influenced by untrusted configuration, this can cause SSRF-like outbound requests and credential exfiltration to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/zhihuiya_description_data.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request headers include values taken directly from environment variables, and the destination URL is also overrideable via LINKFOX_TOOL_GATEWAY. This allows a caller or surrounding runtime to redirect authenticated requests, including the API key and session metadata, to an attacker-controlled endpoint, creating a credential exfiltration/SSRF-style risk in an agent context where environment variables may be attacker-influenced.

Content

Scanner excerpt · scripts/zhihuiya_fulltext_image.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request destination is influenced by the LINKFOX_TOOL_GATEWAY environment variable, so anyone who can control the execution environment can redirect API traffic to an attacker-controlled host. Because the request includes the Authorization API key and session metadata headers, this creates a credential exfiltration and data leakage path rather than a harmless configuration option.

Content

Scanner excerpt · scripts/zhihuiya_patent_image_search.py (reported line 84)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ruiguan_image_compliance_search.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ruiguan_utility_patent_detection.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihuiya_abstract_translated.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihuiya_bibliography.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihuiya_claim_data.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihuiya_description_translated.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihuiya_legal_status.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihuiya_patent_family.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/zhihuiya_pdf_data.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request includes multiple headers populated directly from environment variables, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. This allows untrusted runtime configuration to influence outbound network traffic and potentially exfiltrate sensitive identifiers or the API key to an attacker-controlled endpoint, especially in agent or CI environments where env vars may be externally set.

Content

Scanner excerpt · scripts/zhihuiya_simple_bibliography.py (reported line 79)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""