ClawHub
Back to skill

Security audit

AI口播视频脚本生成专家

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad LinkFox workflow package that can collect product data, persist reports, and use external services beyond simple script generation.

Install only if you are comfortable with LinkFox services receiving product URLs/ASINs, review data, prompts, media URLs, API credentials in headers, and session metadata. Review the gateway environment variable, avoid invoking public file upload for private data, require explicit approval before remote onboarding installs or feedback submissions, and periodically clear local linkfox caches/reports if the product data is sensitive.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (52)

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
96% confidence
Finding
The script reads an API key and multiple metadata values from environment variables, then attaches them to every outbound HTTP request. Because the destination base URL is also environment-controllable via LINKFOX_TOOL_GATEWAY, a poisoned runtime environment can redirect requests and exfiltrate the Authorization header and session metadata to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
94% confidence
Finding
The request sent via urlopen includes multiple headers populated directly from environment variables, and the destination base URL is also overrideable via LINKFOX_TOOL_GATEWAY. In an agent/runtime context, environment variables are attacker-influenced more often than normal CLI usage, so this can exfiltrate API credentials and session metadata to an arbitrary host if the gateway env var is changed.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
The script forwards multiple environment-derived values, including the API key and session identifiers, to a remote HTTP endpoint. Because the gateway base URL is itself overrideable via LINKFOX_TOOL_GATEWAY, an attacker who can influence environment variables can redirect requests and exfiltrate credentials and metadata to an attacker-controlled server.

Tainted flow: 'req' from os.environ.get (line 124, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
)
    timeout = int(os.environ.get("LINKFOX_SYNC_TIMEOUT", "300"))
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            # startCrawlTask 返回格式: { taskId, status, data, errorMsg }
            # 适配上层调用方对 code/success 的判断
Confidence
88% confidence
Finding
The script constructs an outbound HTTP request using multiple environment-controlled values, including headers and an API base URL resolved from configuration, then sends it with urlopen. If an attacker can influence those environment variables or the backend target, they can cause credential-bearing requests to be sent to an unintended service, resulting in SSRF-like behavior and token/header exfiltration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding
The skill advertises high-level prompt-generation behavior, but the documented workflow exercises broad capabilities including network access, local file read/write, and likely environment access without any declared permission boundary. That gap weakens reviewability and least-privilege controls, making it easier for sensitive data handling or side effects to occur without users or operators understanding the real execution scope.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
This is a significant scope-expansion issue: the skill claims to generate Seedance scripts, but the workflow also performs review harvesting, web crawling, AI task dispatch, local persistence, HTML report generation, and OSS upload to a public URL. Hidden or under-disclosed data collection and exfiltration paths increase the chance of unauthorized scraping, leakage of user/product data, and unsafe operation beyond what a user consented to.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The skill states it only generates scripts, yet later includes AI reference-image generation and HTML report persistence. This inconsistency matters because users may provide content under the assumption of text-only processing, while the actual workflow can create new media artifacts and store reports, broadening privacy, copyright, and data-retention risk.

Intent-Code Divergence

High
Confidence
94% confidence
Finding
The documentation explicitly says the expert only generates scripts and not images, but later workflow instructions describe generating reference images. Contradictory operator guidance can bypass user expectations and internal safety routing, leading the agent to perform media-generation tasks it was supposed to delegate to a specialized, separately controlled expert.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The skill instructs that image requests should be handed off to an image expert, but later says to generate those images within the workflow itself. That contradiction undermines trust boundaries and policy enforcement, because a general script skill can silently absorb privileged media-generation behavior that may have different moderation, copyright, or storage controls.

Context-Inappropriate Capability

Low
Confidence
87% confidence
Finding
The documentation exposes a feedback submission endpoint unrelated to the skill’s primary function, creating a secondary data flow to a separate external service. If the skill uses this capability without an explicit user warning and consent boundary, user-provided free text may be transmitted off-path for monitoring or reporting in ways users do not expect.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to automatically send broad categories of user feedback, including praise, dissatisfaction, and anything that 'could be improved,' to a separate Feedback API. That expands behavior beyond the declared ASIN lookup purpose and can result in unauthorized transmission of user content or metadata to another endpoint without clear user awareness or consent.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill directs the agent to download and install another skill from a remote URL when onboarding/authentication issues occur. This introduces a supply-chain risk and unauthorized capability expansion: a product-detail lookup skill should not self-bootstrap by fetching and installing additional code or instructions from the network, especially based on runtime error conditions.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The script does more than a simple product-detail lookup: it creates persistent session directories, metadata indexes, and cache files across runs. In an agent skill, this expands the data-retention surface and can silently store request/response data and session identifiers beyond the user's immediate expectation.

Intent-Code Divergence

High
Confidence
91% confidence
Finding
The docstring promises writes only under the current working directory and explicitly forbids /tmp, but the implementation falls back to the home directory and temp directory. This mismatch is security-relevant because operators may trust the documented storage boundary while the code persists potentially sensitive API output in broader or less protected locations.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to automatically send feedback about user interactions, mismatches, and user sentiment to a separate Feedback API, which expands behavior beyond the stated purpose of fetching and analyzing Amazon reviews. This creates an unauthorized secondary data flow and may transmit user content or metadata without clear consent, violating least-privilege and privacy expectations.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill directs the agent to load or even install another skill when onboarding guidance is missing, which is unrelated to Amazon review retrieval and materially broadens the agent's behavior. Allowing a skill to pivot into fetching and installing additional components introduces supply-chain and scope-expansion risk, especially during error-handling paths where safeguards are often weaker.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The embedded instruction to download a ZIP from a remote URL and install it is a clear remote code/content acquisition path not justified by the skill's stated purpose. Even if framed as onboarding, it creates a supply-chain risk where a compromised URL, modified package, or deceptive replacement skill could introduce arbitrary new behavior or exfiltration paths.

Description-Behavior Mismatch

High
Confidence
84% confidence
Finding
The implemented behavior materially differs from the advertised skill purpose: instead of generating talking-video prompts, this component collects Amazon reviews from a remote service and persists raw results locally. This mismatch increases the chance that users or higher-level agents invoke the skill with inappropriate trust, leading to unintended data collection, network access, and storage of external content.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The documentation states that writing to /tmp is forbidden and that failure to write to the current directory should error out, but the implementation silently falls back to the home directory and then the system temp directory. This creates undisclosed data persistence in locations that may be less protected or more broadly accessible, which is especially risky for cached API responses and review data.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The script implements arbitrary local file upload to publicly accessible OSS URLs, but the skill metadata describes a video-script prompt generator, not a file transfer or hosting utility. That mismatch is security-relevant because it creates an unexpected data exfiltration path: a caller or chained agent could upload sensitive local files under the guise of using a content-generation skill.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The code prints and returns public HTTPS URLs for uploaded files, effectively turning the skill into a public file-hosting mechanism. In the context of a script-generation skill, this is unjustified functionality that can expose confidential inputs or local artifacts to anyone with the link and enable unauthorized publication of sensitive data.

Description-Behavior Mismatch

Medium
Confidence
80% confidence
Finding
This shared path utility includes network capabilities for obtaining cloud upload credentials, uploading local files, and downloading arbitrary media, which exceeds the stated prompt-generation purpose of the skill. Such hidden capability expansion increases the attack surface and makes it easier for other parts of the skill to exfiltrate data or contact external systems without clear user expectation.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The upload_file helper can send any local file path to cloud object storage once temporary credentials are obtained, with no restriction that the file be created by this skill or belong to a safe workspace. In a larger agent pipeline, this creates a straightforward exfiltration primitive for sensitive local files, credentials, reports, or other artifacts.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The download_media helper can fetch arbitrary external HTTP(S) URLs and store the response locally, which is unnecessary for a prompt-generation skill and can be abused as an SSRF or untrusted-content ingestion primitive. Even with scheme checks, it may reach attacker-controlled hosts or internal services if upstream callers pass untrusted URLs.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The generic 'send' command accepts arbitrary workflow JSON from a file or command line and submits it directly to the crawlTask API. In the context of a skill advertised as a talking-video prompt generator, this is an unjustified capability expansion that can be abused to drive unintended browser automation, data extraction, or backend task execution beyond the declared purpose.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
skills/linkfox-plugin-web-data-crawler/scripts/run_crawl.py:110