ClawHub
Back to skill

Security audit

爆款商品图复刻专家

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its image-replication purpose, but it needs review because it can handle credentials, payments, public uploads, and automatic external feedback reporting with weak scoping and consent controls.

Review this skill before installing. Use it only with non-sensitive product images and references you are willing to send to LinkFox services or publish through public OSS URLs. Do not run it in an environment where LINKFOX_* endpoint variables could be set by an untrusted project or wrapper, and avoid storing API keys in shell profiles unless you accept the long-lived credential risk. Confirm paid ASIN lookups, package purchases, and feedback submissions before allowing them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
skills/linkfox-amazon-product-detail/SKILL.md:173
Finding

Unconsented Feedback Telemetry and Promotional Instruction Hijacking

Content
View full analysis
This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` { "skillName": "linkfox-xxx-xxx", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } ``` ### Technical Analysis The nested Skill instructs the Agent to infer user sentiment, result quality, and possible improvements and then report those observations to an external endpoint. The condition “Anything you believe could be improved” is broad enough to make reporting routine rather than exceptional. The instruction also says not to interrupt the user’s flow. Consequently, it discourages disclosure and confirmation before transmitting conversation-derived information. Feedback reporting is not required to retrieve Amazon product information or generate replica images, so it exceeds the minimum privileges and network activ ...[truncated 1272 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/probe_image_size.py:27
Finding

Server-Side Request Forgery Through Unrestricted Image URL Probing

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py:38
Finding

Authentication Credentials and Personal Data Can Be Redirected to Arbitrary Endpoints

Content
View full analysis
str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", " ...[truncated 3886 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skills/linkfox-file-upload/SKILL.md:32
Finding

Unpinned Runtime Dependency Installation Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (81)

Tainted flow: 'req' from os.environ.get (line 297, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py (reported line 202)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 297, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py (reported line 299)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The request sent via urlopen includes multiple headers populated directly from environment variables, and the destination base URL is also overrideable via LINKFOX_TOOL_GATEWAY. In an agent/runtime context, this creates a real SSRF and credential-exfiltration risk because a malicious or compromised environment can redirect requests to an attacker-controlled host while forwarding the API key and session metadata.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/amazon_product_detail.py (reported line 80)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The script allows network destinations to be overridden by environment variables and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and payment-related requests to those URLs. In a skill/onboarding context, environment control is often outside the user’s visibility, so a malicious host process or wrapper could redirect these requests to an attacker-controlled endpoint and silently exfiltrate credentials.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The gateway URL is derived from environment variables and used to make authenticated requests with the user’s API key in the Authorization header. If an attacker can influence the environment, they can redirect account, package, and order operations to an attacker-controlled server and capture the API key and related metadata.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是AIGC商品图片生成/复刻能力，但提供的代码完全没有图像处理、上传商品图、读取亚马逊 listing/ASIN、参考图风格迁移或批量生成图片的逻辑。相反，代码专注于账户注册登录、令牌获取、套餐购买和支付流程，属于账号开通/商业支付配套工具。虽然这可能是某个图像技能的配套 onboarding 脚本，但就该代码块本身的实际行为而言，其主要目的与声明用途明显不一致，且包含多项未在描述中体现的账户与支付相关能力，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个图像生成/编辑类技能，核心能力应是接收商品图和参考图或 ASIN/listing，并生成新的商品图片。但代码没有任何图像处理、下载图片、模板套用、批量出图或与参考图风格迁移有关的逻辑。其唯一核心功能是调用 LinkFox 网关的 /amazon/product/detail 接口查询亚马逊商品详情，随后缓存并写入本地文件。因此主目的与实际行为存在明显且实质性的偏差。文件落盘和缓存本身可视为支持实现细节，但在这里它们进一步表明该脚本是数据抓取/查询工具，而不是图像复刻工具。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是图像生成/图片风格复刻类能力，核心应涉及图片输入、亚马逊 listing/ASIN 解析、参考图风格迁移或批量出图。但代码中完全没有任何图像处理、亚马逊商品抓取、ASIN/listing 解析或批量生成图片的逻辑。相反，代码专注于 LinkFox 平台的账户 onboarding 和商业化流程，包含短信登录、获取 API token、套餐查询、下单支付和订单查询。这不仅是主用途明显不同，还包含多项未声明的账户与支付相关能力，因此属于明确的 description-behavior mismatch。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个商品图生成/复刻能力，核心应包括基于参考图或亚马逊 listing 信息进行图像分析、版式/风格迁移以及批量生成新图。但提供的代码仅实现文件上传功能：检查本地文件是否存在，调用 get_sts_voucher() 获取上传凭证，再调用 upload_file() 上传到 OSS，最后打印 JSON 结果和公开 URL。其主要目的与声明完全不同，且代码暴露了未声明的外部存储上传能力。因此这是明显的描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是图像排版/风格迁移和批量出图能力，但代码中没有任何图像处理、亚马逊 listing/ASIN 解析、参考图样式分析、模板套用或批量生成逻辑。相反，代码提供的是底层基础设施能力：文件命名、会话目录管理、元数据记录、远程获取上传凭证、OSS 文件上传、以及媒体下载。这些能力可能作为某个图片处理技能的配套组件存在，但就该代码块本身而言，其实际行为与声明的核心用途明显不一致，且包含未在描述中体现的网络访问与文件上传/下载能力。因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The fixed prompt mandates that output text language be inferred from the reference image's country/language rather than chosen by the user. This can cause the system to generate unintended or misleading market-facing content, including text the user cannot review, and it amplifies prompt influence from untrusted reference images instead of explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs the agent to 'immediately' run a Python script and forbids waiting for user confirmation, even though execution triggers external API requests, polling, file downloads, and local persistence. This removes an important consent and safety checkpoint, making unintended charges, privacy exposure, and unauthorized actions more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger condition is overly broad and directs activation even when the user does not explicitly ask for product-detail retrieval, which can cause the agent to invoke a paid external data-collection workflow unnecessarily. In security terms, broad trigger logic increases the chance of unintended data disclosure, excess billing, and tool invocation on ambiguous requests.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/SKILL.md (reported line 131)May include surrounding context.

text
Parameters: `{"asins": "B072MQ5BRX", "amazonDomain": "amazon.co.uk", "device": "mobile"}`

## Display Rules

1. **Present data clearly**: Show product details in a well-structured format -- use tables for specifications and pricing comparisons, bullet lists for "About This Item" content
2. **Image handling**: When the response includes image URLs (`productImageUrls`, `thumbnail`, `imageUrl`), present them as clickable links or embedded images as appropriate

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills/linkfox-aigc-imagegen/references/onboarding.md (reported line 14)May include surrounding context.

md
示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/references/onboarding.md (reported line 14)May include surrounding context.

md
示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code can generate or retrieve an API token for the user’s group and then return it to stdout, creating a powerful credential issuance path inside the skill. In this skill context, generating long-lived account credentials is more dangerous because it is not obviously required for the stated image-generation task and could enable unauthorized API use beyond the session.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/linkfox-file-upload/references/api.md (reported line 32)May include surrounding context.

md
未列出的扩展名（`png` / `jpg` / `jpeg` / `pdf` / `mp4` / `xlsx` / `zip`）交给 oss2 推断，它推得对。

**不写 UTF-8 BOM**：BOM 能讨好本地双击打开的 Excel，但会污染文件字节、破坏 md 首行标题解析、也让按 URL 取内容的下游读到 ``。需要 Excel 直接打开的交付走 `.xlsx`，不要用 CSV。

注意 charset 只随 HTTP 响应头走。文件下载到本地后响应头就没了，编辑器仍按自己的默认编码猜——这是本 skill 无法覆盖的边界。

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill orchestrates network access, local file handling, and likely environment-backed credentials, but does not declare an explicit tool/permission scope. That makes the effective capability boundary opaque to reviewers and users, increasing the chance of overbroad access, unsafe composition with sub-skills, or accidental data exposure. In this context the risk is heightened because the workflow uploads images, fetches Amazon data, reads local paths, and persists artifacts across multiple steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill sends user product images, reference images, and Amazon listing-derived content to other skills/services and may upload local files to public URLs, but the description does not provide a clear user-facing warning or consent point. This creates a privacy and data-governance risk, especially if product images, unpublished creative assets, or sensitive listing data are processed by third-party services and persisted locally or remotely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Forcing a fixed Chinese prompt source without user opt-in can cause users to send inputs into a language-transformation path they did not choose, which may affect output fidelity, policy compliance expectations, and informed consent. The security impact is limited, but it becomes more relevant here because prompts are routed to downstream generation services and prompt wording materially changes model behavior.

Content

No source excerpt is available for this finding.