ABA关键词速查与挖掘专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:30 AM UTC
• Version: 1.0.0

Overview

The package mostly supports Amazon keyword research, but it also bundles broader remote AI, public upload, feedback-reporting, and skill-editing behaviors that need review before use.

Install only if you are comfortable with this package using LinkFox API credentials, sending keyword and prompt data to external services, writing session files locally, and potentially creating public OSS links. Review or remove the bundled AIGC, file-upload, auto-feedback, onboarding-install, and skill-creator instructions if you only want ABA keyword lookup/mining.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (42)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request URL and several outbound headers are derived from environment variables, including LINKFOX_TOOL_GATEWAY, SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME, and are sent directly over the network. In an agent/runtime context where environment variables may be attacker-influenced, this enables SSRF-like redirection to an arbitrary endpoint and unauthorized exfiltration of execution metadata and the API key-bearing request.

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The script sends environment-derived secrets and metadata, including the API key and session identifiers, in outbound HTTP headers to a configurable base URL. Because LINKFOX_TOOL_GATEWAY can override the default destination, an attacker who can influence the environment can redirect requests and exfiltrate credentials and request data to an arbitrary server.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 93% confidence
• Finding: `download_media()` performs arbitrary outbound HTTP(S) requests to a caller-supplied URL and writes the response to disk with no allowlist, IP filtering, redirect controls, or private-network protections. In an agent/runtime context this is a classic SSRF primitive that can be used to probe internal services, access cloud metadata endpoints, or retrieve attacker-chosen content into the workspace.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documentation instructs execution of local Python scripts, use of networked Amazon/API workflows, and writing downloadable artifacts, yet no permissions are declared. That creates a transparency and policy-enforcement gap: users and the platform cannot accurately assess or constrain what the skill can access, including filesystem, environment, and network resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is narrow keyword lookup/mining, but the analyzed behavior indicates unrelated high-risk capabilities such as generic text generation, arbitrary local file upload to public OSS URLs, HTML report generation/injection, and persistent storage. This mismatch is dangerous because it hides materially broader data-handling and exfiltration capabilities behind an innocuous business-tool description, increasing the chance that users provide sensitive inputs without informed consent.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Allowing this skill to create or modify other skills is an unnecessary privilege escalation path unrelated to ABA keyword lookup. A compromised or abused session could use this meta-capability to plant new behaviors, weaken controls, or propagate malicious logic into other skills, expanding impact beyond the original tool.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The documentation adds a separate public feedback submission endpoint that is unrelated to the core ABA keyword lookup/mining function. In an agent-skill context, unrelated endpoints expand the action surface and can cause the agent to transmit user content or inferred outcomes to an external service without a clearly scoped user request, creating data leakage and unintended side effects.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to download and install another skill from an external URL when onboarding guidance is missing, expanding behavior beyond ABA query functionality into network retrieval and supply-chain modification. This creates a trust-boundary violation: a documentation file for data lookup should not direct automatic acquisition of additional executable/agent capabilities, especially without integrity verification, provenance checks, or explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill mandates automatic feedback API reporting based on user praise, dissatisfaction, or perceived improvement opportunities, which is unrelated to core ABA search-term querying. This introduces hidden telemetry and possible exfiltration of user interaction data without clear consent, minimization, or disclosure of what is sent.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring promises writes are confined to <cwd>/linkfox and forbids /tmp, but the implementation falls back to ~/linkfox and the system temp directory. This discrepancy can cause sensitive API responses to be persisted in locations the operator does not expect, weakening data handling guarantees and making cleanup/access control harder.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file documents an AI text-generation API and belongs to `linkfox-aigc-textgen`, while the declared skill metadata describes ABA keyword lookup/mining. This mismatch is dangerous because it can cause an agent or reviewer to invoke capabilities outside the user-approved scope, enabling unintended data flow to a different backend and undermining trust, auditability, and least-privilege assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documented feedback submission endpoint is unrelated to ABA keyword lookup/mining and introduces an additional outbound transmission path to an external service. Hidden or undocumented secondary channels are risky because they may send user content or operational details to a third party without clear user expectation or authorization.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is an AI text-generation client, which does not match the declared skill purpose of ABA keyword lookup/mining. Such capability drift is dangerous because it can cause an agent to send user prompts or business data to an unrelated remote AIGC service under false pretenses, defeating user and platform trust boundaries.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The hardcoded endpoints /aigc/textGenAsync and /aigc/textTaskQuery clearly target text-generation services unrelated to Amazon keyword-mining. In the context of a keyword lookup skill, this mismatch materially increases risk because operators and downstream agents may unknowingly expose sensitive prompts, keywords, or internal data to an undisclosed external workflow.

Description-Behavior Mismatch

Medium

• Confidence: 74% confidence
• Finding: This shared utility includes generic OSS upload and arbitrary remote media download capabilities that exceed the declared keyword-lookup/mining scope of the skill. In an agent environment, broad file-transfer primitives increase the attack surface by enabling data staging, remote content ingestion, and off-scope persistence that other scripts in the skill can reuse.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script always writes session artifacts to disk in LinkFox environments and also auto-saves an Excel file when no output path is provided, creating persistent local data without explicit user consent. This can expose sensitive search terms, market research, or operational metadata to other local users, backup systems, or later processes, and it violates the principle of least surprise for a lookup/mining tool.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script persists results to disk even when the user did not explicitly request output, including automatic session-directory exports and a fallback default file path. In a skill context, this creates an undisclosed data-retention channel for user-provided seeds and mined results, which can expose sensitive research terms or leave artifacts on shared systems.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The code comments and CLI flow imply output is user-specified, but the implementation later always writes files when LinkFox is present. This mismatch is dangerous because users and downstream agents may believe the tool is non-persistent unless asked, leading to accidental disclosure or retention of potentially sensitive input and results.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documentation exposes a generic file-upload capability that obtains STS credentials, uploads arbitrary supported files to OSS, and returns a publicly accessible HTTPS URL, which is unrelated to the stated ABA keyword lookup/mining purpose. This unnecessary capability expansion increases attack surface and creates a risk of data exfiltration, unintended public hosting, or misuse of the agent's API key and upload channel.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file’s stated functionality is uploading arbitrary local files to Alibaba OSS and returning public URLs, which is unrelated to the declared ABA keyword lookup/mining skill purpose. Capability mismatch is dangerous because it can hide unexpected data exfiltration behavior inside a skill that users would reasonably trust for keyword research, increasing the likelihood of misuse or unnoticed leakage.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script accepts arbitrary local paths from the command line, uploads those files to a remote OSS service, and produces publicly accessible HTTPS URLs. In the context of a keyword-mining skill, this is unjustified and creates a direct exfiltration path for sensitive local data, especially because there is no restriction to expected file types tied to the advertised task.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The preset phrases are generic operational queries such as '关键词ABA速查' and '精确词最新周快照', which can plausibly overlap with ordinary user requests rather than acting as narrowly scoped, unambiguous skill invocations. This can cause unintended skill activation, routing user requests into this skill without clear opt-in, increasing the chance of prompt/intent hijacking or incorrect handling of requests.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The manifest hard-codes a Chinese-language expert role, goals, workflow, and output context without any indication that output language should follow user preference. This can override the surrounding system or user language context, causing instruction-priority confusion, degraded safety review quality, or unintended transformations when handling non-Chinese requests.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The trigger scope is overly broad and explicitly says the skill should activate even when ABA is not mentioned, allowing it to capture loosely related requests such as general keyword or market analysis. Overbroad activation increases the chance of unnecessary tool use, unexpected data access, and user confusion about what system is acting on their request.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The markdown directs the agent to download and install another skill from the network without a strong safety warning, provenance guarantee, or execution-trust disclosure. Because skills can alter agent behavior, this creates a supply-chain and remote-content risk disproportionate to the stated purpose of querying ABA data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:101

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: skills/linkfox-amazon-suggestion-miner/SKILL.md:55

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: skills/linkfox-amazon-widget-miner/SKILL.md:41