ABA关键词速查与挖掘专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:23 AM UTC
• Version: 1.0.1

Overview

The keyword-mining functions are coherent, but the package needs Review because it adds under-disclosed feedback transmission and risky credential/network handling.

Install only if you trust LinkFox with your keyword queries, prompts, session metadata, and any optional feedback reports. Avoid custom LINKFOX_* gateway environment overrides unless they point to a trusted HTTPS LinkFox endpoint, review any feedback before submission, do not upload private files through the file-upload helper, and use an isolated environment with pinned dependencies where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: skills/linkfox-aba-intelligent-query/SKILL.md:159

Finding

Silent Transmission of Conversation-Derived Feedback to an External Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:75

Finding

Configurable Gateway Can Redirect API Credentials and User Data to an Untrusted Host

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-report-generator/scripts/inject_report.py:157

Finding

Report Injector Allows Arbitrary HTML and JavaScript Execution

Content

View full analysis

str: echarts_code = "" m = _ECHARTS_BLOCK_RE.search(content) if m: echarts_code = m.group(1).strip() echarts_code = _SCRIPT_OPEN_RE.sub("", echarts_code) content = _ECHARTS_BLOCK_RE.sub("", content).strip() canvas_code = "" m = _CANVAS_BLOCK_RE.search(content) if m: canvas_code = m.group(1).strip() canvas_code = _SCRIPT_OPEN_RE.sub("", canvas_code) content = _CANVAS_BLOCK_RE.sub("", content).strip() html = template.replace("{{TITLE}}", title or "LinkFox Analysis Report") html = html.replace("{{LANG}}", language) html = re.sub( r".*?", "\n" + content + "\n", html, flags=re.DOTALL, ) if echarts_code: html = html.replace( "// ECHARTS_INIT_START\n // ECHARTS_INIT_END", "// ECHARTS_INIT_START\n " + echarts_code + "\n // ECHARTS_INIT_END", ) if canvas_code: html = html.replace( "// CANVAS_INIT_START\n // CANVAS_INIT_END", "// CANVAS_INIT_START\n " + canvas_code + "\n // CANVAS_INIT_END", ) return html ``` ### Technical Analysis The injector treats the supplied fragment as trusted HTML. It directly inserts `content` into the final document without escaping or sanitization. For chart blocks, the only attempted defense is a regular expression that removes literal opening and closing `script` tags. The JavaScript body remains and is inserted into script regions already present in the report template. Removing tag text do ...[truncated 1885 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skills/linkfox-aba-intelligent-query/scripts/onboarding.py:166

Finding

Unpinned Runtime Dependencies Create Supply-Chain Exposure

Content

View full analysis

None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` The project also instructs users to install dependencies without version or integrity constraints: ```text pip install qrcode pillow pip install requests pip install oss2 pip install openpyxl ``` No reviewed version constraints, hashes, or dependency lock file were identified in the audited project structure. ### Technical Analysis Installing packages only by name causes the package resolver to retrieve whichever version currently satisfies the request. The resulting environment is not reproducible and can change after the Skill has been reviewed. If a package account, release channel, dependency, or configured package index is compromised, installation can introduce unreviewed code. Python packages may execute code during installation and later execute with the privileges of the Skill process when imported. This finding does not establish that the named packages are currently malicious. It identifies the absence of controls needed to ensure that the installed code is the same code that was reviewed. ### Attack Path 1. A user invokes a feature requiring `requests`, `qrcode`, `Pillow`, `oss2`, or `openpyxl`. 2. The dependency is missing, and the Skill instructs the user to run an unpinned `pip install` command. 3. The configured package index supplies the latest available release and its transitive dependencies. 4. A compromised or unexpectedly changed release installs or is imported. 5. Package code executes with the user's process permissions. 6. That code may access fi ...[truncated 540 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (121)

Tainted flow: 'req' from os.environ.get (line 96, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/amazon-aba-kw-snapshot/scripts/aba_common.py (reported line 111)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/aba_query.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The POST target URL is derived from environment-controlled base URLs, and the same request path can carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and team identifiers. If an attacker can influence the environment, they can redirect these requests to an attacker-controlled host and exfiltrate credentials or payment-related data; in a skill that already handles login and token issuance, this context makes the issue more dangerous.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request uses a URL assembled from environment-controlled base configuration and sends the LinkFox API key in the Authorization header. An attacker who can set the environment can reroute this traffic to a malicious server and capture the API key, user/account metadata, or manipulate order and package responses; because this script also supports order creation and account operations, the blast radius is substantial.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The POST target URL is derived from environment-controlled base URLs such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, and the function sends sensitive material including SMS login data, access tokens, refresh tokens, and generated API keys to that destination. If an attacker can influence the runtime environment, this becomes credential exfiltration or SSRF-to-attacker infrastructure with little friction.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The urllib gateway request uses a URL assembled from environment-controlled LINKFOX_AGENT_API_URL/LINKFOX_TOOL_GATEWAY and attaches the Authorization API key header. An attacker who can set the environment can redirect these requests to an arbitrary server and harvest API keys or induce outbound requests to internal services.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request sends LINKFOX_AGENT_API_KEY from the environment to a network endpoint whose base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. If an attacker can influence that endpoint, the code will transmit the API token to an arbitrary server, enabling credential exfiltration and unauthorized API use.

Content

Scanner excerpt · skills/linkfox-amazon-suggestion-miner/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-suggestion-miner/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The download_media function performs outbound HTTP requests to an arbitrary caller-supplied URL with only a scheme check for http/https. This is a classic SSRF primitive: an attacker who controls the URL can make the agent contact internal services, cloud metadata endpoints, or other sensitive network locations, and then persist the response locally.

Content

Scanner excerpt · skills/linkfox-amazon-widget-miner/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

download_media() performs outbound requests to any caller-supplied http(s) URL and then writes the response to local storage. That creates an SSRF primitive that can be used to reach internal services or attacker-controlled endpoints, and the skill context does not justify arbitrary remote fetching for a keyword lookup/export tool.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-widget-miner/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

download_media() performs arbitrary outbound fetches to any attacker-controlled http:// or https:// URL with no allowlist, host validation, or private-network protections. In an agent/runtime context this creates a classic SSRF primitive that can be used to reach internal services, cloud metadata endpoints, or other network-restricted resources, and the downloaded content is then written into the session workspace.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a combination of local directory and metadata management, authorization-token use from environment variables, external STS retrieval, arbitrary file upload, arbitrary remote download, and global indexing. In the context of a mislabeled keyword tool, this is highly dangerous because it can support data exfiltration, covert storage, or abuse of ambient credentials.

Content

No source excerpt is available for this finding.