ABA关键词热度分析师

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:30 AM UTC
• Version: 1.0.0

Overview

The skill is an Amazon keyword analytics workflow, but it also has broad external-service, public upload, local persistence, and skill-modification paths that need review before installation.

Install only if you are comfortable sending Amazon keyword prompts, ASINs, image/media URLs, and possibly local product/report files to LinkFox, Amazon, AIGC, and OSS services. Avoid sensitive or private files unless you explicitly want public URLs, keep LINKFOX_TOOL_GATEWAY pinned to a trusted endpoint, and consider removing or gating the expert-skill-creator self-extension step and automatic upload paths before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (49)

Tainted flow: 'req' from os.environ.get (line 96, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 90% confidence
• Finding: The request destination is partially controlled by the LINKFOX_TOOL_GATEWAY environment variable and the code sends an Authorization header containing the API key to that URL. If an attacker can influence the runtime environment, they can redirect requests to an attacker-controlled host and exfiltrate credentials and query data; this is a real tainted outbound flow rather than a harmless network call.

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The script constructs outbound HTTP headers from environment variables, including `LINKFOX_AGENT_API_KEY`, `SESSION_ID`, `MESSAGE_ID`, `MODE_ID`, and `APP_NAME`, and sends them to a configurable endpoint via `urlopen`. Because `get_api_base()` honors `LINKFOX_TOOL_GATEWAY` from the environment, an attacker who can influence runtime configuration can redirect requests and exfiltrate credentials and session metadata to an arbitrary host.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 93% confidence
• Finding: The function performs arbitrary HTTP/HTTPS fetches from a caller-supplied URL and stores the response locally, which creates an SSRF-style primitive and allows untrusted network access beyond the stated analytics scope. Even though non-HTTP schemes are rejected, this still permits access to internal services, metadata endpoints, or unexpected large/hostile content if the URL is attacker-controlled.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill’s declared purpose is narrowly framed as ABA keyword heat analysis, but the workflow expands into file upload, multimodal image/PDF understanding, and other auxiliary skills. That mismatch is dangerous because operators or policy engines may grant trust based on the narrow description while the actual behavior processes additional data types and invokes external services, increasing attack surface and data-handling risk beyond user expectation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: Allowing an analysis skill to invoke `expert-skill-creator` to create or modify skills introduces a self-extension pathway unrelated to the stated ABA analysis function. This is dangerous because it can enable privilege expansion, policy bypass, or persistence by turning a narrow data-analysis tool into a meta-programming agent that changes its own capabilities or spawns new ones.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The self-extension capability is unjustified by the business purpose of an ABA keyword heat analyst and therefore violates least privilege. Even absent obvious malicious instructions, embedding capability growth into a domain-specific skill increases the blast radius if the skill is misused, prompt-injected, or chained with other tools.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The skill expands its role from ABA keyword analysis into image upload and image-recognition orchestration, including delegating user-supplied images and prompts to other scripts. That broadening of capability increases data-exposure and supply-chain risk because users invoking a keyword-analysis skill may not expect local files or image URLs to be sent through additional processing components.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The referenced API document is for a different skill (`linkfox-aigc-textgen`) than the declared Amazon ABA keyword heat analysis skill. This kind of cross-skill mismatch is dangerous because it can cause the agent to invoke unrelated remote capabilities, including transmitting user prompts and media to an external text-generation service under false pretenses. In this context, the mismatch increases risk because users and reviewers would reasonably expect ABA analytics behavior, not AIGC content generation.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The file documents a feedback submission endpoint that is not justified by the stated ABA keyword heat analysis purpose. An undocumented or weakly justified outbound feedback channel can be abused to transmit user content, operational details, or derived data to a separate external service, expanding the skill's data egress surface beyond its apparent function. Because this skill is presented as analytics-focused, the extra reporting path is more suspicious and less contextually appropriate.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements generic AI text generation and async task polling, which materially differs from the manifest claim of Amazon ABA keyword heat analysis. This capability mismatch is dangerous because it can bypass user expectations and policy controls, enabling broader data processing or content generation than the declared skill scope suggests.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill embeds a generic `download_media` capability unrelated to its stated ABA keyword-analysis purpose, expanding the attack surface without clear need. Unused or off-scope network-and-file functionality can be abused for arbitrary remote fetches, local storage of attacker-controlled content, and policy evasion via hidden secondary behavior.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The module includes generic cloud upload and arbitrary media download features that exceed the declared purpose of Amazon ABA keyword heat analysis. This capability expansion increases attack surface and enables data movement off-host or untrusted content retrieval without clear necessity, which is especially concerning in a shared utility used by multiple skills.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code retrieves API-token-backed STS credentials and enables cloud uploads, which is a data egress capability not justified by the stated analytics-only function of the skill. If other parts of the skill can write arbitrary files and call this helper, sensitive outputs could be uploaded externally using inherited credentials.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file is clearly an Amazon suggestion miner, while the manifest describes an ABA weekly keyword heat analyst. This mismatch is dangerous because users or higher-level orchestration may grant permissions, trust, or make decisions based on the declared purpose, while the code actually performs a different network-driven data collection workflow.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The implementation adds translation-based multi-market suggestion mining behavior that is materially different from the declared ABA heat-analysis scope. In an agent skill ecosystem, undeclared cross-market querying expands data access and network activity beyond user expectations, increasing the risk of misuse, policy violations, or accidental collection of unintended data.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code includes broad local export capabilities to JSON, CSV, XLSX, and SQLite that are not reflected in the manifest’s stated analytics purpose. Undeclared persistence is risky because it can leave sensitive query inputs, results, or derived data on disk where users, other processes, or later runs may access them unexpectedly.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The file’s own documentation describes a different tool than the manifested skill purpose, reinforcing that the code and advertised capability diverge. This is dangerous in security-sensitive automation because operators may execute the skill under false assumptions, granting trust and data access to a workflow they did not intend to run.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The documented capability is for mining Amazon public suggestion/widget data, which materially differs from the declared skill purpose of ABA keyword heat analysis. This mismatch is dangerous because it can conceal undeclared data collection or scraping behavior from reviewers and users, weakening trust boundaries and making abuse or policy-violating functionality harder to detect.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script’s documented and implemented behavior is materially different from the declared skill purpose: it performs Amazon suggestion/widget mining rather than ABA weekly heat analysis. This kind of capability mismatch is dangerous because users or orchestrators may grant the skill access and network execution under false assumptions, enabling undisclosed scraping behavior and data collection.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The code automatically writes JSON/XLSX artifacts to disk, including default and session-directory saves, while the skill is presented as a focused analytics tool. Undisclosed persistence can leak queried keywords, result data, and usage traces to local storage where other processes or users may access them.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description uses broad trigger language such as '当用户要热度报告、给图验词、ASIN找词做热度可视化时触发', which can match a wide range of ordinary e-commerce analysis requests rather than a tightly scoped command. In an agentic system, this increases the chance of over-invocation, causing the skill to activate on loosely related prompts and potentially process images, ASINs, or keyword data unexpectedly.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script launches an external helper while forwarding the entire process environment, which may expose secrets such as API keys to code outside this file. In a skill ecosystem where helper script locations can vary, full environment inheritance increases blast radius if a helper is compromised or replaced.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When a local image path is supplied, the script automatically calls an upload helper and extracts a public URL from its output, with no confirmation, policy gate, or indication to the caller that local data may leave the host. In a skill context, users may reasonably expect local files to be processed locally, so silent exfiltration of product or internal images is a real privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script forwards image data by URL plus free-form requirement text to an external recognition helper without any explicit disclosure or control over where analysis occurs. Because this skill is designed for image-based keyword inference, sending potentially sensitive images to third-party services is contextually plausible but still dangerous if users are not informed and administrators cannot restrict external processing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs the skill to send a free-form natural-language `analysisDescription` to an external endpoint, but it does not warn that user-provided content will be transmitted off-platform. Because natural-language prompts can contain business-sensitive terms, product plans, identifiers, or other confidential context, users may unknowingly disclose data to a third-party service. In this skill context, bulk keyword and ABA trend analysis increases the likelihood that commercially sensitive search strategy data is included in requests.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: skills/linkfox-amazon-suggestion-miner/SKILL.md:55

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: skills/linkfox-amazon-widget-miner/SKILL.md:41