ABA关键词热度分析师

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:16 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its ABA keyword-analysis purpose, but it bundles high-impact account, credential, upload, report, and self-modification behaviors that need careful review.

Install only if you trust LinkFox and are comfortable with API keys, account onboarding, public file uploads, and generated HTML reports. Before use, avoid overriding LinkFox gateway environment variables, review any payment or API-key action explicitly, do not open or host generated reports from untrusted keywords without sanitization, and use a virtual environment with pinned dependencies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/amazon-aba-kw-heat-report/scripts/generate_report.py:400

Finding

Stored Cross-Site Scripting in Generated ABA HTML Reports

Content

View full analysis

' + i.label + '

' + (i.value == null ? '—' : i.value) + '

' + (i.sub ? '

' + i.sub + '

' : '') + ''; }).join(''); function buildSmallMultiples() { const grid = document.getElementById('smGrid'); grid.innerHTML = ''; const x = DATA.all_dates || []; DATA.chart_series.forEach(function(s, idx) { const m = metricByName(s.name) || {}; const tile = document.createElement('div'); tile.className = 'sm-tile' + (s.name === focusKw ? ' active' : ''); tile.dataset.kw = s.name; tile.innerHTML = '

' + s.name + 'SFR ' + (m.latest_sfr == null ? '—' : m.latest_sfr) + '

'; ``` ```javascript function renderTable() { const tb = document.querySelector('#metricsTable tbody'); tb.innerHTML = DATA.metrics_table.map(function(m) { const yoy = m.avg_yoy_change_pct; const yoyStr = (typeof yoy === 'number') ? ((yoy>0?'+':'') + yoy + '%') : yoy; const trClass = m.keyword === focusKw ? ' class="focus-row"' : ''; return '' + '' + m.keyword + '' + '' + tierLab ...[truncated 2745 chars]

Remediation

View remediation

``` Populate that element using a serializer that escapes at least `<`, `>`, `&`, U+2028, and U+2029, then parse its `textContent`. 3. Replace all `innerHTML` string construction with DOM APIs: - Use `document.createElement()`. - Assign untrusted values through `textContent`. - Use `setAttribute()` only after validating the value. 4. Validate color fields against a strict allowlist, such as six-digit hexadecimal colors generated internally by the report. 5. Treat keywords, trend labels, dates, and all remote ABA response fields as untrusted. 6. Add regression tests using payloads that contain: - Closing script tags. - Image elements with error handlers. - Quotes that escape `data-kw`. - Malicious CSS attribute values. 7. Deploy a restrictive Content Security Policy as defense in depth, avoiding `unsafe-inline` scripts where possible. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/amazon-aba-kw-heat/scripts/aba_common.py:12

Finding

Credential Disclosure Through Unrestricted Environment-Controlled API Destinations

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python base = _get_agent_base() api_token = os.environ.get("LINKFOX_AGENT_API_KEY") or "" url = f"{base}/oss/getStsVoucherByAPI" req = Request( url, method="POST", data=b"{}", headers={"Content-Type": "application/json", "Authorization": api_token}, ) ``` The onboarding script independently allows destination replacement: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```p ...[truncated 2175 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skills/linkfox-file-upload/SKILL.md:32

Finding

Unpinned Runtime Dependency Installation Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skills/linkfox-aigc-textgen/scripts/onboarding.py:1

Finding

Text-Generation Skill Exposes Over-Scoped Account and Payment Operations

Content

View full analysis

login [channel] list-plans order query ``` Payment-order creation is implemented as follows: ```python def create_order(plan_id: str, method: str) -> dict: if method not in PAY_METHOD_MAP: raise ValueError(f"unsupported payment method {method}") user = fetch_user_info() is_team = bool(user.get("isTeamUser")) member_id = _jwt_uid().get("uid", "") if not member_id: raise RuntimeError("unable to decode uid from the API key") body = { "packageId": plan_id, "payType": PAY_METHOD_MAP[method], "payDeviceType": "PC", "memberId": member_id, "groupId": user.get("currentGroupId", ""), } path = "/order/createTeamOrderByAPI" if is_team else "/order/createByAPI" resp = _check_biz(_gateway("POST", path, body), "create order") ``` The login flow obtains an account access token and then retrieves or creates a reusable API key: ```python def login_and_get_key(phone: str, code: str, channel: str) -> dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": "invalid phone number", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": "invalid verification code", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) ...[truncated 2544 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (131)

Tainted flow: 'req' from os.environ.get (line 96, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The code builds an outbound HTTP request using multiple environment-controlled values, including the base gateway URL and several headers such as SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME, and the authorization key. Because LINKFOX_TOOL_GATEWAY is not validated against an allowlist, an attacker who can influence the runtime environment can redirect requests and exfiltrate credentials, session metadata, and user-supplied analysis content to an arbitrary server.

Content

Scanner excerpt · skills/amazon-aba-kw-heat/scripts/aba_common.py (reported line 111)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The script reads sensitive values from environment variables, including the API key and session metadata, and sends them in outbound HTTP headers to a configurable gateway endpoint. Because the destination can be overridden by LINKFOX_TOOL_GATEWAY, any attacker who can influence environment configuration can redirect these secrets to an attacker-controlled server, resulting in credential leakage and request metadata exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends highly sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence the runtime environment, they can redirect these requests to a hostile server and exfiltrate credentials or session material; in an onboarding skill, this is especially dangerous because users are expected to enter fresh authentication secrets.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway URL is derived from environment variables and then used by urllib.request.urlopen together with the Authorization header carrying LINKFOX agent API credentials. An attacker who controls the environment can redirect order, package, or account requests to an attacker-controlled endpoint and capture the API key or manipulate responses, enabling credential theft or fraudulent workflow behavior.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

download_media performs outbound requests to any caller-supplied http/https URL and writes the response to disk, with no host allowlist, IP-range validation, or redirect restrictions. This is a classic SSRF primitive that can be used to reach internal services, cloud metadata endpoints, or attacker-controlled large responses; in an analytics skill, arbitrary network fetch is broader than necessary and therefore more dangerous.

Content

Scanner excerpt · skills/linkfox-amazon-suggestion-miner/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

download_media performs arbitrary outbound requests to any caller-supplied http/https URL and stores the response locally. This creates an SSRF-style primitive that can be abused to access internal services, cloud metadata endpoints, or other unintended network locations, which is unrelated to the stated ABA keyword analytics purpose and therefore more suspicious in context.

Content

Scanner excerpt · skills/linkfox-amazon-widget-miner/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-suggestion-miner/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-widget-miner/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly performs HTML template injection and local file output rather than actual ABA/SFR analysis, the core issue is integrity and scope deception rather than a direct exploit by itself. However, local file-writing and template-based report generation can still become a delivery mechanism for unsafe content or hidden data persistence under an inaccurately benign description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes on-the-fly self-modification or skill-generation behavior unrelated to its analytical purpose. Self-extension is particularly dangerous because it can bypass the original review scope, introduce new tool use or prompts at runtime, and make the skill's behavior non-stationary and harder to audit.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Because lower SFR means hotter demand, a negative change (b - a) / a indicates heating up. The code labels negative changes as 明显升温/升温, but elsewhere the UI and summary note explain the same SFR semantics; however lines 95-103 conflict with ordinary reading only if checked carefully against the metric definition, and the contradiction becomes explicit in the labels around later displays that treat positive SFR increases as cooling. This makes the intent documentation around trend direction inconsistent with the implemented label mapping.

Content

No source excerpt is available for this finding.