ClawHub
Back to skill

Security audit

AI品牌视觉基因专家

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its brand-style extraction purpose, but it bundles account, credential, billing, and payment flows with weak endpoint and file-path controls that users should review before installing.

Install only if you are comfortable with LinkFox-hosted processing of prompts and image/video URLs, and treat the bundled onboarding and billing flows as sensitive account operations. Avoid using this with private media or secrets unless authorized, do not paste API keys into shell profiles if you can use a safer secret store, and ensure LinkFox endpoint environment variables and SESSION_ID are controlled by trusted configuration.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:75
Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Configured Endpoints

Content
View full analysis
str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ...[truncated 2976 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/linkfox-aigc-textgen/scripts/onboarding.py:484
Finding

API Keys Are Exposed Through Standard Output and Recommended Plaintext Persistence

Content
View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` The onboarding documentation recommends persisting that key in shell startup files: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The onboarding CLI is designed to return JSON through standard output. Returning the complete API key through that channel makes it available to every layer that captures command output, including an orchestrating agent, transcript storage, CI logs, shell pipelines, debugging infrastructure, or terminal history copied into support records. The accompanying instructions further recom ...[truncated 1610 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/save_brand_gene.py:37
Finding

Unvalidated SESSION_ID Allows Session Output Path Traversal

Content
View full analysis
str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join( _linkfox_root(), ...[truncated 2445 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (32)

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material to those endpoints via requests.post. In this file, those requests carry SMS-login tokens, refresh tokens, authorization headers, uid/tid metadata, and can reach API-token generation paths, so a malicious or tampered environment can redirect secrets to attacker-controlled infrastructure.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. If an attacker can influence the runtime environment, they can redirect authenticated gateway traffic, capture API keys, and induce unauthorized account, package, or order operations.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a brand-style extraction utility, but it also performs persistent local file writes and path handling that are not clearly disclosed in the top-level purpose. Description/behavior mismatch is dangerous because reviewers and orchestrators may grant trust or invoke the skill under a narrower mental model than its real side effects, increasing the chance of unauthorized persistence or data handling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a brand-style extraction utility, but it also performs persistent local file writes and path handling that are not clearly disclosed in the top-level purpose. Description/behavior mismatch is dangerous because reviewers and orchestrators may grant trust or invoke the skill under a narrower mental model than its real side effects, increasing the chance of unauthorized persistence or data handling.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a brand-style extraction utility, but it also performs persistent local file writes and path handling that are not clearly disclosed in the top-level purpose. Description/behavior mismatch is dangerous because reviewers and orchestrators may grant trust or invoke the skill under a narrower mental model than its real side effects, increasing the chance of unauthorized persistence or data handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file is referenced under a brand-gene extraction skill context, but the content documents a different text-generation API and workflow. This kind of skill-documentation mismatch can cause an agent to call the wrong backend, send the wrong data type (e.g. brand/image inputs as freeform text prompts), or apply incorrect auth/error-handling logic, creating a real integrity and data-flow security risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This reference file embeds account-authentication, registration, and billing workflows inside a skill whose stated purpose is brand-gene extraction from images. That creates unjustified scope expansion: a content-analysis skill should not instruct the agent to collect credentials, trigger login flows, or mediate billing, especially through local scripts. In context, this is more dangerous because the capability is unrelated to the declared skill and could be abused to socially engineer users into handing over account data or performing sensitive account actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented behavior includes registering accounts by phone, obtaining API keys, listing plans, and creating payment orders, none of which are necessary for extracting a brand visual identity. This unjustified capability expansion increases attack surface around identity, account access, and payments. Because the parent skill is unrelated to account lifecycle management, users and downstream agents may trust instructions that are outside expected boundaries, making abuse more plausible.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skills/linkfox-aigc-textgen/references/onboarding.md (reported line 14)May include surrounding context.

md
示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements asynchronous text generation and polling, while the declared skill metadata describes brand-gene extraction from product images. This capability mismatch is dangerous because orchestration and approval systems may grant network, data, or trust assumptions based on the declared purpose, allowing a materially different function to run under misleading metadata.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script calls /aigc/textGenAsync and /aigc/textTaskQuery, which are text-generation endpoints unrelated to the stated brand visual extraction purpose. In the context of a skill ecosystem, hidden or mislabeled network behavior increases the risk of data misuse, unauthorized task execution, and policy bypass because reviewers and callers may rely on the manifest description rather than the real behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements account onboarding, SMS authentication, API-key retrieval, billing, and order management, which is materially unrelated to the declared brand-gene extraction skill. This mismatch is dangerous because users or calling workflows may invoke a supposedly image-style skill while actually triggering credential collection and account-linked commerce actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code can create paid orders and render payment QR codes despite the skill being advertised as brand-gene extraction. In context, hidden billing capability is especially risky because it expands the blast radius from content generation into financial operations that a downstream orchestrator or user would not reasonably expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file performs SMS-based login, refresh-token handling, team discovery, and API-token generation, all unrelated to the stated image-style extraction purpose. In a mismatched skill, this behavior functions as covert credential acquisition and privilege enablement, increasing the risk of unauthorized account access and token leakage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to use environment data, write files into a session directory, and call another tool/networked skill, yet it declares no explicit tool scope or allowed-tools boundary. In an agentic environment this widens the effective privilege surface, making unintended file writes, environment-derived path use, or external calls harder to audit and constrain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases include broad terms like '品牌视觉' and '定义品牌风格' without strong exclusion logic, which can cause the skill to activate in situations beyond the intended narrow workflow. Over-broad triggering increases the chance of accidental invocation, unnecessary data processing, and unintended file persistence or downstream calls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The input schema sets language default to "英文", and later logic applies English automatically when the field is empty. This imposes a language choice by default rather than offering a user-selected locale, which is a natural-language policy concern unless clearly justified as region-specific behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The procedure explicitly states that if language is empty it defaults to "英文". This operationalizes a fixed language choice without asking the user, and no opt-in or alternative selection path is provided nearby.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is very broad, including common phrases like '帮我写一段', '图片识别', and '视频分析', which can cause the skill to activate for many generic requests. In an agent environment, overly broad routing increases the chance that user content, image URLs, or video URLs are sent to this external text-generation service without clear intent or least-privilege selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly supports sending prompts and image/video URLs to an external model service, but the user-facing description does not warn that supplied content will leave the local system for third-party processing. This creates a privacy and data-handling risk because users may provide sensitive text or private media under the assumption that analysis is local or internal.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The documented workflow instructs transmission of prompts, media URLs, task IDs, and auth headers to an external gateway. External transmission is expected for API use, but in this skill context it becomes security-relevant because the file is mismatched to the declared skill and may cause data intended for brand-gene extraction to be sent to an unrelated text-generation service.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/references/api.md (reported line 111)May include surrounding context.

| 10009 | 任务不存在 | 检查 taskId 是否正确 | | 其他 | 业务异常 | 参考 errmsg 字段 |

curl 示例

bash
# 1. 创建任务

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation includes a feedback submission capability unrelated to the stated brand-gene extraction purpose. Unrelated outbound-capable features increase attack surface and can mislead an agent into transmitting user-derived content to an external service outside the expected skill function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The feedback API explicitly sends user feedback content to an external endpoint, but the documentation provides no privacy warning, data-classification guidance, or restriction on including personal or sensitive data. In an agent setting, this omission can lead to inadvertent exfiltration of user content, operational details, or regulated data.

Content

No source excerpt is available for this finding.