Etsy商品查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:54 PM UTC
• Version: 1.0.9

Overview

This Etsy lookup skill also includes account login, API-key generation, payment-order creation, and under-disclosed local response storage, so it should be reviewed before installation.

Install only if you are comfortable giving the skill access to your LinkFox API key and using it for paid LinkFox account workflows. Treat the phone/SMS login, API-key output, plan selection, and payment QR/order creation as sensitive actions; confirm each step yourself, avoid sharing secrets unnecessarily, and review or clean the local linkfox output/cache directories after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill declares no permissions, yet its documented behavior and referenced scripts imply access to environment variables, file output, and external network services. This creates a capability-transparency gap: a user or orchestrator may invoke a seemingly simple product-query skill without realizing it can read secrets, write files, or contact remote services, increasing the risk of secret exposure, unauthorized side effects, or hidden data exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose is Etsy product filtering, but the skill also includes onboarding, authentication, account lookup, subscription purchasing, payment initiation, QR code generation, and order-status polling. That is a major behavior mismatch which can trick users or higher-level agents into invoking account, billing, and login workflows under the guise of a read-only query tool, potentially causing credential collection, unwanted purchases, or disclosure of account data.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The top-level documentation promises that full responses are written only under the current working directory and explicitly forbids /tmp, but the implementation can silently fall back to ~/linkfox or the system temp directory. That mismatch can cause sensitive API responses and session metadata to be persisted in locations the operator did not expect, weakening data handling guarantees and potentially exposing data to other local users or cleanup processes.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements phone-based onboarding, SMS login, API key acquisition, plan listing, order creation, and payment QR generation, which is materially different from the declared Etsy product query skill. This mismatch is dangerous because a user or agent invoking an Etsy-search skill could instead be guided into credential submission, account provisioning, and billing flows unrelated to the advertised capability.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Embedding order placement, subscription purchase, and QR payment generation inside an Etsy product filtering skill creates unjustified financial and account-management capability. In context this is especially risky because the skill description would not lead users or integrators to expect billing actions, increasing the chance of deceptive prompts, misuse, or accidental purchases.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation conditions are overly broad, causing the skill to trigger for almost any Etsy-related request, even when the user did not ask for this specific tool. In the context of a skill that can also lead into authentication, quota handling, and payment-related flows, over-triggering increases the chance of unintended execution, unnecessary data sharing with third-party services, and steering users into costly actions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The instructions direct the agent to collect and process a user's phone number, verification code, and API key, but provide no privacy notice, consent language, masking guidance, or safe-handling requirements. In an agent workflow, this creates a real risk of unnecessary exposure of credentials and personal data through chat logs, terminal history, or downstream tools.

Ssd 3

Medium

• Confidence: 87% confidence
• Finding: The skill is explicitly designed to always persist complete API responses and session-linked metadata to disk, which can retain potentially sensitive query contents, identifiers, and returned business data beyond the immediate task. In an agent context, automatic durable storage increases blast radius if the workspace is shared, synced, backed up, or later accessed by unrelated processes or users.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.