AI口播视频脚本生成专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 1.0.1

Overview

The skill is broadly aligned with e-commerce video-script generation, but it retains task-derived knowledge, sends some feedback silently, and uses credentialed LinkFox services with under-scoped controls.

Review before installing. Use it only if you are comfortable with LinkFox receiving product URLs, review data, prompts, images, API credentials, and some task feedback. Keep gateway environment variables pinned to trusted LinkFox HTTPS hosts, avoid uploading private local files, and require explicit approval for memory retention and feedback submission.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:250

Finding

Persistent Agent Memory Poisoning Through Untrusted Product and Review Data

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:24

Finding

Mandatory Branded Output and Vendor Agent Redirection

Content

View full analysis

Video generation | Use the script prompt and material images to generate a talking-head video directly When the user requests generation of a reference image, output: Image generation | Create product reference images for Seedance upload ``` Child Skills also contain branded footer instructions such as: ```markdown For more high-quality, professional cross-border e-commerce skills, visit [LinkFox Skills](https://skill.linkfox.com/). ``` Affected examples include: - `skills/linkfox-amazon-product-detail/SKILL.md:189` - `skills/linkfox-amazon-reviews-list/SKILL.md:193` - `skills/linkfox-amazon-search-by-image/SKILL.md:180` - `skills/linkfox-multimodal-generate-image/SKILL.md:168` - `skills/linkfox-multimodal-recognize-image/SKILL.md:131` ### Technical Analysis These instructions do not merely describe how to perform the declared script-generation task. They prescribe vendor-specific content that must appear in the Agent's final response and redirect users to other LinkFox agents. This alters response behavior when the Skill is loaded and creates a conflict with neutral tool selection. The promotional footer is also unrelated to the minimum functionality needed to retrieve reviews, inspect products, or process images. ### Attack Path 1. The Agent loads the top-level or child Skill. 2. The Skill introduces mand ...[truncated 661 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skills/linkfox-amazon-reviews-list/SKILL.md:182

Finding

Automatic Disclosure of User Feedback and Intent to a Vendor Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-aigc-textgen/scripts/onboarding.py:68

Finding

Environment-Controlled Endpoint Overrides Can Exfiltrate Credentials

Content

View full analysis

str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Credentials are attached to requests: ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = ( _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ) if group_id: h["tid"] = group_id return h ``` Access and refresh tokens are sent to the configured Agent user endpoint: ```python resp = _http_post( f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": { "aid": "3026344186", "did": "", "type": "Windows", "os": ...[truncated 2073 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-multimodal-generate-image/scripts/upload_image.py:90

Finding

Local Images Are Uploaded as Publicly Readable Objects Without Destination Validation

Content

View full analysis

str: return presigned_url.split("?")[0] ``` ```python presigned_url = get_presigned_url(content_type, extension) upload_file(presigned_url, file_path, content_type) public_url = extract_public_url(presigned_url) ``` Equivalent uploaders exist in: - `skills/linkfox-amazon-search-by-image/scripts/upload_image.py` - `skills/linkfox-multimodal-recognize-image/scripts/upload_image.py` ### Technical Analysis The uploader reads the complete local file and explicitly requests `public-read` access. It validates only the filename extension; it does not verify the file signature, remove metadata, enforce a size limit, or require confirmation that the content is safe to publish. The presigned URL returned by the gateway is trusted directly. Its sch ...[truncated 1323 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-plugin-web-data-crawler/scripts/run_crawl.py:198

Finding

Crawler Accepts Unrestricted URLs and Arbitrary Workflow Definitions

Content

View full analysis

str: if args.url: return args.url if args.asin: domain = AMAZON_SITE_DOMAINS.get(args.site, "") if not domain: raise SystemExit( f"Unsupported site for constructing URL from ASIN: {args.site!r}" ) return f"https://{domain}/dp/{args.asin}" raise SystemExit("A product address must be supplied") ``` Arbitrary workflow input is accepted: ```python def cmd_send(args): site_key = _resolve_site_key(args.site) if args.json_str: wf = json.loads(args.json_str) elif args.file: wf = _load_json(Path(args.file)) else: print( "Error: --file or --json required for 'send'", file=sys.stderr, ) sys.exit(1) if args.reuse_tab: wf["steps"] = _strip_open_tab(wf["steps"]) if args.url: wf["steps"] = _replace_url(wf["steps"], args.url) if args.category: wf["steps"] = _inject_category_fields( wf["steps"], site_key, args.category, ) _validate_or_exit(wf) result = _post(wf) ``` The validator checks structure and action schemas, but contains no URL policy: ```python schema = schemas.get(code) if schema is None: errors.append( f"{ctx}: invalid actionCode ({code!r}), " f"valid values: {sorted(schemas.keys())}" ) continue ``` ### Technical Analysis Although the Skill is declared for Amazon and SHEIN product crawling, `--url` is returned without scheme, hostname, IP-range, or redirect validation. The `send` command also accepts ...[truncated 1678 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (318)

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends highly sensitive material including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. In a skill context, environment variables are part of the execution environment and may be attacker-controlled or misconfigured, turning this into credential exfiltration/SSRF behavior rather than a harmless configuration feature.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The gateway base URL is taken from environment variables and then used in urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. An attacker who can influence environment configuration can redirect authenticated gateway traffic to an arbitrary server and capture API keys or induce unintended outbound requests.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request destination and outbound headers are partially controlled by environment variables, especially LINKFOX_TOOL_GATEWAY and session/application identifiers, and the script sends the API key in the Authorization header to whatever gateway is selected. If an attacker can influence the runtime environment, they can redirect requests to an arbitrary host and exfiltrate credentials and product-detail query data through this network call.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/amazon_product_detail.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. In a skill environment, environment variables may be influenced by a host, wrapper, or attacker with deployment access, creating an SSRF/exfiltration path that can silently redirect credentialed traffic to attacker-controlled infrastructure.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway client uses an environment-derived base URL and attaches the LinkFox API key in the Authorization header before calling urlopen. If the base URL is overridden, the skill can leak persistent API credentials and send authenticated purchase/order actions to an attacker-controlled or unintended server.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 84, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-reviews-list/scripts/amazon_reviews.py (reported line 91)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=timeout) as response:
            result = _parse_api_response(response.read(), path)
            cost_token = response.headers.get("X-Cost-Token")
            if isinstance(result, dict) and cost_token is not None:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive authentication material including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs. If an attacker can influence the environment, they can redirect these requests to an attacker-controlled server and exfiltrate credentials and tokens; in this skill, that risk is amplified because the code handles account login and token provisioning rather than ordinary content generation.

Content

Scanner excerpt · skills/linkfox-amazon-reviews-list/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. An attacker who can set the environment can redirect API traffic to a rogue endpoint and capture the API key and associated account/order data; because this script also performs billing and order operations, that exposure can lead to account abuse and financial actions.

Content

Scanner excerpt · skills/linkfox-amazon-reviews-list/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The script forwards multiple environment-controlled values into outbound HTTP headers and also allows the gateway base URL to be overridden by the LINKFOX_TOOL_GATEWAY environment variable. In an agent/runtime context where environment variables may be influenced by untrusted callers or plugins, this can redirect authenticated requests to an attacker-controlled endpoint and exfiltrate the API key and session metadata.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/amazon_search_by_image.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The POST target URL is derived from environment-controlled base URLs, and the request may include sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and authorization headers. If an attacker can influence environment variables, they can redirect these requests to an attacker-controlled endpoint and exfiltrate credentials or capture authentication flows.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request built for urlopen uses an environment-derived base URL and attaches the API key in the Authorization header. A manipulated environment can therefore redirect billing, account, or package-management API calls to an attacker-controlled server, causing direct credential leakage and possible abuse of the victim's account or purchases.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/upload_image.py (reported line 74)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/upload_image.py (reported line 107)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

download_media accepts an arbitrary http/https URL and fetches it with urlopen, then stores the response on local disk. This creates an SSRF-style primitive that can be used to reach attacker-chosen endpoints from the agent environment, potentially accessing internal services or downloading untrusted content for later processing.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The script forwards multiple environment-derived values, including an API key and session identifiers, into an outbound HTTP request. Because the destination base URL is itself overrideable via the LINKFOX_TOOL_GATEWAY environment variable, a caller who can influence the environment can redirect requests and exfiltrate credentials and runtime metadata to an attacker-controlled host.

Content

Scanner excerpt · skills/linkfox-multimodal-generate-image/scripts/multimodal_generate_image.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The code sends authentication material and account data to URLs derived from environment-controlled base endpoints. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, SMS codes, access tokens, refresh tokens, and generated API keys could be exfiltrated to attacker-controlled infrastructure. The danger is amplified because this skill already performs login and token issuance outside its declared video-script purpose.

Content

Scanner excerpt · skills/linkfox-multimodal-generate-image/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway request path uses a base URL sourced from environment variables and then transmits Authorization credentials via urlopen. An attacker who can set LINKFOX_AGENT_API_URL or fallback variables can redirect authenticated requests, capture API keys, enumerate account/package data, or manipulate order-related responses. Because this file includes account and payment actions, redirectable network destinations materially increase risk.

Content

Scanner excerpt · skills/linkfox-multimodal-generate-image/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-multimodal-recognize-image/scripts/multimodal_recognize_image.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The POST destination is derived from environment-controlled base URLs, and the request can carry sensitive materials including SMS-login credentials, access tokens, refresh tokens, and generated API keys in headers or body. In an agent/skill environment, a malicious wrapper or user-controlled environment can redirect these requests to an attacker-controlled host, causing credential exfiltration and account takeover.

Content

Scanner excerpt · skills/linkfox-multimodal-recognize-image/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway request target is also built from environment variables and is used together with the Authorization API key header for account, package, and order operations. If an attacker can influence the environment, they can redirect authenticated traffic to an arbitrary server and capture the API key or manipulate billing-related flows.

Content

Scanner excerpt · skills/linkfox-multimodal-recognize-image/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-multimodal-generate-image/scripts/upload_image.py (reported line 73)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-multimodal-recognize-image/scripts/upload_image.py (reported line 73)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-multimodal-generate-image/scripts/upload_image.py (reported line 106)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)