ClawHub
Back to skill

Security audit

Etsy-商品详情

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly performs an Etsy listing lookup, but it also includes account login, API-key issuance, payment-order flows, automatic feedback reporting, and broad local persistence that need careful review.

Install only if you are comfortable with a LinkFox-paid-service workflow that may use your LinkFox API key, guide users through SMS login, create payment orders on request, write lookup results and QR artifacts to local disk, and submit feedback externally. Review endpoint environment variables and avoid providing phone numbers, verification codes, API keys, or payment actions unless the user explicitly requested that flow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
97% confidence
Finding
The request sent via urlopen includes attacker-influenced environment data in headers, most notably SESSION_ID, MODE_ID, APP_NAME, and an API key, while the destination base URL is also overridable through LINKFOX_TOOL_GATEWAY. In an agent environment, this creates a real exfiltration path: a malicious or tampered environment can redirect authenticated requests and associated metadata to an arbitrary server, leaking secrets and user/session context.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
96% confidence
Finding
The HTTP POST destination is derived from environment-controlled base URLs and the request can carry sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In an agent/runtime setting where environment variables may be influenced by deployment or another component, this creates an exfiltration path to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
The gateway request uses a URL built from environment-controlled base configuration and includes the agent API key in the Authorization header. If the base URL is altered, the script will send credentials and account/order data to an attacker-controlled server, enabling credential theft and misuse of the linked account.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation indicates use of environment variables, network access, and file writes, but no explicit permissions are declared. This creates an authorization and transparency gap: an agent may access secrets like API keys, write potentially sensitive response data to disk, and make external requests without the permission model clearly surfacing those capabilities to users or reviewers.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a simple Etsy listing detail lookup, but its referenced behavior includes account login, SMS verification, API-key acquisition, account inspection, package purchasing, payment QR generation, and order-status queries. This is a significant scope expansion into authentication and billing operations, which can expose users to credential handling, unauthorized purchases, and hidden account actions far beyond the stated purpose.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The file documents a second external API for feedback submission that is unrelated to the core Etsy listing-detail retrieval function. In an agent-skill context, extra endpoints expand the skill’s capability surface and can enable unintended outbound data transmission, especially if future tool logic uses this section to send user-derived content off-platform without a clear user request.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill persistently stores full API responses plus session metadata to local files even though the skill purpose is only to look up and return Etsy listing details. This broadens data exposure by creating durable artifacts containing listing data, session identifiers, timestamps, and usage history that may be accessible to other local processes, later tasks, or users sharing the workspace.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The docstring promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation instead falls back to home and temporary directories. This mismatch is security-relevant because operators may rely on the documented storage boundary, while the code silently writes sensitive response data and metadata to less controlled locations, increasing unintended disclosure risk.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This file implements login, API-key issuance, subscription management, and payment workflows that are unrelated to the stated purpose of retrieving public Etsy listing details. Such scope divergence is dangerous because it introduces credential collection and monetization capabilities into a skill that users would reasonably expect to perform only passive public-data lookup.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code performs SMS-based login and generates or retrieves API credentials despite the skill being described as a public Etsy listing parser. Collecting authentication factors and issuing keys in this context greatly increases the risk of credential abuse, user confusion, and covert account linkage beyond the advertised function.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Plan enumeration, order creation, and payment QR generation are unrelated to public Etsy listing parsing and add unnecessary financial transaction capabilities. In a mismatched skill context, this creates a deceptive path for charging users or steering them into purchases they did not expect from a product-detail lookup tool.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The script creates session directories and writes QR code artifacts to disk even though filesystem persistence is not necessary for the stated Etsy-detail lookup use case. Unnecessary local storage increases the chance of leaking payment links, session identifiers, or other sensitive operational artifacts to other users or processes on the host.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The Feedback API section instructs sending free-form content to an external service but provides no warning that the content may contain user information, request details, or other sensitive data. In an LLM agent environment, this omission increases the risk of privacy leakage because implementers may treat the endpoint as harmless telemetry and automatically forward user prompts or outputs to a third party.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document instructs operators to collect and process a user's phone number and one-time verification code to register/login, but it provides no privacy notice, consent guidance, retention limits, or safe-handling requirements for this personal data. In a support/onboarding workflow, this creates avoidable risk of improper collection, disclosure, or over-retention of sensitive account-linked information.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill retrieves or generates API tokens and handles authentication material without an explicit warning or consent flow. In this context, users expecting Etsy listing details may not realize they are authorizing account access and credential issuance, increasing the risk of accidental over-sharing and unauthorized downstream use.

Missing User Warnings

Low
Confidence
74% confidence
Finding
The order flow writes QR code image files to disk without clearly notifying the user of the filesystem side effect. While lower severity than credential issues, this can leave behind payment artifacts and paths that expose transaction data or clutter shared environments unexpectedly.

Static analysis

No suspicious patterns detected.