Etsy类目搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:42 PM UTC
• Version: 1.0.9

Overview

This Etsy category lookup skill also includes account login, API-key generation, and payment-order flows that users should review before installing.

Install only if you are comfortable letting this skill contact LinkFox services, use a LinkFox API key, and guide users through phone-based login or payment flows when auth or billing errors occur. Treat any SMS code and returned API key as sensitive, avoid endpoint override environment variables unless you control them, and review generated linkfox cache/session files for retained data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request sent via urlopen includes multiple values taken directly from environment variables, including the API key and session-related headers, and the destination base URL is also environment-controllable through LINKFOX_TOOL_GATEWAY. This creates a real exfiltration path: in a hostile or multi-tenant execution environment, an attacker can redirect requests to an arbitrary server and receive credentials and query data.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code sends authentication data and other sensitive payloads to URLs derived from environment-controlled base endpoints. If those environment variables are modified, the script can be redirected to attacker-controlled infrastructure, causing credential, token, phone number, or payment-flow data exfiltration. In this skill, that risk is amplified because the script’s stated behavior is unrelated to Etsy category lookup and instead performs account onboarding and login flows.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway request path uses urllib to send API-key-authenticated requests to a base URL that can be supplied via environment variables. An attacker who can influence the environment can redirect these requests, capturing the LinkFox API key and all associated account, package, and order data. Because this skill claims to be a local Etsy category search utility, this hidden network-capable credential flow is especially suspicious and dangerous.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: This skill is presented as a simple Etsy category lookup, but the linked onboarding/auth/payment flows indicate access to account login, API key provisioning, account data retrieval, plan purchase, and payment status operations. That mismatch can mislead users and orchestrators into invoking a skill with materially broader authority than expected, increasing the risk of credential handling, account actions, or payment-related abuse under an innocuous description.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill writes full API responses, session identifiers, and metadata to local files even though the declared function is category lookup. This increases data retention and local exposure risk, especially if responses contain account context, internal identifiers, or other metadata not needed for the user-facing task.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The implementation sends search queries to a remote gateway although the skill description says it should search a locally synced Etsy category library. That mismatch is security-relevant because users may expect local-only processing, while their queries and session metadata are actually transmitted off-host.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The module documentation claims output is forbidden from /tmp and will be written under the current working directory, but the code silently falls back to the home directory or temporary directory. This discrepancy can place data in less controlled locations, weakening operator assumptions about where sensitive outputs and metadata are stored.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements LinkFox account onboarding, login, API key retrieval, purchasing, and payment operations instead of Etsy category lookup described in the manifest. This is a strong capability mismatch that can mislead users or reviewers into invoking unrelated sensitive behavior under the guise of a harmless search skill. Such deception increases the likelihood of unauthorized credential collection and financial actions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: These network routines are used for authentication, account, and payment-related API access that is unrelated to Etsy category search. Hidden external operations expand the attack surface, enable data exfiltration, and make it possible for the skill to interact with remote services in ways users would not expect from a local category lookup utility. The mismatch between declared purpose and actual behavior materially increases risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: SMS verification, login, token exchange, and API-key generation are not justified for an Etsy category lookup skill. These features directly handle sensitive user identifiers and credentials, creating an unnecessary pathway for credential harvesting or unauthorized account linkage. In context, the unjustified credential flow is more dangerous because it is embedded inside a tool that should not need any account onboarding at all.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Listing plans, creating orders, and rendering payment QR codes are commerce operations unrelated to category search. Embedding purchase workflows in a skill advertised as a lookup utility creates risk of deceptive monetization, unexpected charges, and unauthorized financial actions. The context makes this substantially more dangerous because users would not reasonably expect payment initiation from an Etsy taxonomy helper.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code creates session directories and writes QR image artifacts to disk even though the advertised skill purpose is local category lookup. Writing payment-related artifacts to persistent storage increases exposure of transaction data and can leave sensitive remnants accessible to other local users or processes. While less severe than credential exfiltration, it is still unjustified and expands risk.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger conditions are broad enough to fire on generic requests about Etsy categories or local category-ID lookup, even when the user did not explicitly request this tool. Overbroad activation increases the chance of unintended tool use and becomes more concerning here because the skill appears connected to broader auth/billing flows, so mistaken invocation could expose users to unexpected side effects.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document instructs operators to collect and process a user's phone number and verification code through a local script, but it provides no privacy notice, consent guidance, storage/retention limits, or handling safeguards. This creates a real security and privacy weakness because highly sensitive authentication data may be transmitted or exposed through agent workflows without clear boundaries, increasing the risk of account takeover or improper data handling.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The script generates or retrieves an API token and returns it in stdout JSON without any in-file warning about sensitivity, storage, or safe handling. In agent and automation environments, stdout is often logged, copied, or persisted, so emitting secrets this way can leak reusable credentials. Given the mismatch with the skill’s declared purpose, exposing an API key is especially risky.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.