AI品牌视觉基因专家

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.0

Overview

The main brand-style extraction skill is understandable, but it bundles and relies on a broader LinkFox text-generation skill that can handle API keys, phone login, and payment ordering beyond the main purpose.

Review before installing. Use this only if you are comfortable sending product image URLs, brand parameters, and prompts to LinkFox services and storing generated JSON in the session data directory. Treat LINKFOX_AGENT_API_KEY as a secret, verify any LINKFOX_* endpoint environment variables point to trusted LinkFox domains, and avoid phone-number login or payment-order steps unless you intentionally want account onboarding or billing actions through this skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The code constructs request destinations from environment-controlled base URLs and then sends sensitive data to them via requests.post. Because this script handles SMS login, access tokens, refresh tokens, user identifiers, and API-token generation, a hostile or misconfigured environment can redirect those secrets to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The urllib gateway path also derives its target URL from environment variables and automatically attaches the LinkFox API key in the Authorization header. If an attacker can influence environment configuration, they can exfiltrate the API key and other account data by forcing requests to an arbitrary server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructions require capabilities to access environment variables, write files into the session data directory, and invoke a networked downstream text-generation skill, yet no permissions are declared. This creates a hidden trust boundary: operators or callers may treat the skill as low-risk while it can exfiltrate data via network calls or persist sensitive content locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is narrow brand-gene extraction, but the referenced behavior includes unrelated high-risk functions such as reading API keys from the environment, making authenticated external requests, login/SMS flows, order creation, and payment QR generation. That mismatch is dangerous because it can conceal materially broader capabilities than users or orchestrators expect, enabling credential misuse, data exfiltration, or financial side effects under the cover of a benign image-branding skill.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The file being audited is described in the surrounding metadata as a brand-gene extraction skill, but the actual SKILL.md declares a different skill, linkfox-aigc-textgen, with unrelated capabilities and triggers. This kind of skill/manifest mismatch can cause incorrect routing, policy bypass, or invocation of a more powerful multimodal text-analysis capability than the caller or reviewer intended.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file documents authentication recovery, phone-based registration, and billing/payment flows inside a skill whose declared purpose is brand-gene extraction. This expands the skill's effective operational scope into credential setup and commercial transactions, creating a confused-deputy risk where a content-generation skill can prompt for sensitive data or steer users into account/payment actions unrelated to the requested task.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented flow explicitly includes collecting a phone number, sending login codes, obtaining API keys, listing plans, and creating payment orders, none of which are justified by the skill's advertised image-brand analysis function. In this context, those capabilities materially increase the chance of unauthorized data collection, credential handling, and payment abuse if the skill is invoked unexpectedly or by a compromised orchestrator.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements asynchronous text generation, while the declared skill is supposed to extract brand-gene/style information from product images and brand parameters. This capability mismatch is dangerous because it can cause agents to invoke a skill under false assumptions, leading to unintended data handling, incorrect downstream automation, and potential abuse of privileges or billing under a misleading identity.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module includes a generic URL-fetching/download helper unrelated to the advertised brand-gene extraction purpose and unused by the primary flow. Dormant network-capable code expands the attack surface and can later be abused for arbitrary external fetches or SSRF-like behavior if exposed through future parameters or chained agent use.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module docstring and usage text explicitly describe a text-generation skill, directly contradicting the manifest's brand-gene extraction description. This inconsistency is a strong trust and safety issue because operators and calling agents may grant access, route inputs, or interpret outputs based on false capability metadata.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements account onboarding, SMS authentication, API-key acquisition, package listing, ordering, and payment QR rendering, which is materially unrelated to the declared brand-gene extraction skill. This mismatch is a strong indicator of deceptive packaging and increases the risk that operators invoke credential and billing logic they did not intend to install.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Embedding SMS login, token exchange, API-token generation, and purchase/order capabilities inside a brand-style extraction skill creates an unjustified path to collect credentials and initiate billing actions. In this context, these capabilities are especially dangerous because users and reviewers would not expect account takeover or monetization workflows inside an image-branding utility.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list contains broad natural-language phrases such as '帮我写一段', '图片识别', and '视频分析', which are common requests and may activate this skill outside the user's intended workflow. Because this skill can process text, images, and video and can feed outputs into downstream AIGC chains, unintended activation increases the chance of over-broad data handling, wrong-tool execution, or cascading actions based on ambiguous user input.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs callers to send arbitrary prompts and media URLs to an external AI generation API but does not warn that user-provided content will leave the local skill boundary and be processed by another service. In this skill ecosystem, prompts and image/video URLs may contain sensitive business, personal, or proprietary data, so the omission can lead to uninformed disclosure and compliance/privacy issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Feedback API section explicitly uses a separate external endpoint, but the documentation does not warn that feedback content may include user statements, issue details, or other potentially sensitive data that will be transmitted outside the main tool API path. This creates a meaningful risk of accidental sharing of personal, confidential, or regulated information through support/telemetry flows.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions tell the operator to ask the user for a phone number and use it in a registration script, but provide no privacy notice, data-handling explanation, retention limits, or consent language. That omission can lead to unnecessary collection of personally identifiable information and increased phishing/social-engineering risk, especially because the request appears inside an unrelated creative skill.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The login flow returns a freshly obtained API key in stdout JSON, which is likely to be captured by host logs, chat transcripts, shell history tooling, or downstream agents. Exposing long-lived credentials through standard output materially increases the chance of accidental disclosure and unauthorized reuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 84% confidence
• Finding: This request path transmits sensitive authentication material and user data to external services. External transmission is expected for login functionality, but in this skill context it is still dangerous because the network destinations are environment-influenced and the overall functionality is unrelated to the advertised purpose.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.