Etsy店铺查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 1.0.9

Overview

The skill’s Etsy query function is real, but it also includes account signup, SMS login, API-token generation, and paid order creation that users should review carefully before installing.

Install only if you are comfortable using LinkFox’s external service, sharing an API key and optional phone/SMS login details with that service, and potentially creating unpaid payment orders for credits. Prefer self-service account setup on the official LinkFox site, avoid giving SMS codes to an agent unless you understand the flow, and review the local linkfox output/cache directory for saved responses or QR images.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares itself as an Etsy store query tool, yet static analysis detected environment access, file writing, and network capabilities without corresponding declared permissions. This reduces transparency and weakens review boundaries, especially because these capabilities can be used to access secrets, persist artifacts, or contact external services beyond the user’s apparent request.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The described skill purpose is Etsy store filtering, but the behavior reportedly extends into account login, SMS verification, API key acquisition, user/team data access, plan listing, order creation, payment-status checks, and QR-code generation. This is a severe scope expansion that could collect credentials, trigger billing flows, and access unrelated account data under the guise of a search skill.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring states writing to /tmp is forbidden, but _linkfox_root can fall back to tempfile.gettempdir(). That mismatch can cause operators to incorrectly assume sensitive API responses never land in temporary storage, increasing the chance of unintended exposure on shared systems or less-protected temp directories.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements LinkFox account onboarding, SMS authentication, API key retrieval, plan listing, and payment workflows, none of which are necessary for an Etsy store query/filtering skill. This mismatch is dangerous because it expands the skill into credential collection and monetization flows under an unrelated pretext, increasing the likelihood of covert data harvesting or unauthorized account actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code can retrieve or generate API tokens for LinkFox groups using authenticated session data. In the context of an Etsy store query skill, token issuance is unjustified and highly dangerous because it can mint reusable credentials that enable broader platform access beyond the user’s apparent request.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script creates paid orders and renders payment QR codes, capabilities unrelated to Etsy store discovery. Embedding payment initiation inside an analytics/search skill creates clear risk of unauthorized purchases, deceptive upsells, or coercing users into paying for unrelated services.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code sends SMS verification codes and logs users in by phone number, then pivots into token and account operations. For an Etsy store query skill, this is an unjustified credential-collection path that could be used to harvest phone numbers, intercept authentication flows, and obtain downstream account access.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger condition is intentionally broad, including cases where the user does not mention the tool name and only generally refers to finding or analyzing Etsy stores. Overbroad activation can cause the skill to run unexpectedly, increasing the chance that users are funneled into hidden authentication, billing, or unrelated backend actions without clear intent.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Forcing Chinese-language behavior without user opt-in can mislead users about what the skill is doing and reduce informed consent, particularly when the skill also contains onboarding, quota, or payment guidance. While not a direct exploit by itself, language coercion can obscure important warnings and increase the risk of users approving actions they do not fully understand.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to collect a user's phone number and use it in a registration flow, but it provides no consent language, privacy notice, retention guidance, or limits on how that personal data should be handled. In an agent context, this creates unnecessary privacy and compliance risk because sensitive personal data may be solicited and processed without clear disclosure or minimization.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script silently sends API credentials plus SESSION_ID, MODE_ID, and APP_NAME to a remote service without any runtime disclosure or consent prompt. In an agent/tooling context, hidden transmission of environment-derived identifiers and authentication material is sensitive because users may not realize what metadata leaves the local environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script persists the full API response to disk every time, which may include sensitive business data or identifiers, while the surrounding documentation/commentary is inconsistent about storage behavior. In agent environments, undisclosed durable storage increases data retention and accidental exposure risk, especially when paths may resolve outside the expected project directory.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 76% confidence
• Finding: This function transmits user-supplied and account-related data, including phone numbers, SMS codes, access tokens, and related metadata, to external services. External transmission is particularly risky here because the skill’s declared purpose is Etsy store querying, so users would not reasonably expect unrelated account-onboarding data flows.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.