Back to skill

Security audit

电商图片裂变专家

Security checks across malware telemetry and agentic risk

Overview

This skill discloses real image-generation behavior, but it also publicly uploads local images, handles account/API-key and payment flows, and is explicitly aimed at avoiding marketplace image association checks.

Only install this if you are comfortable sending product images and prompts to LinkFox services, making local images publicly accessible when upload is needed, and using LinkFox account credentials in this agent environment. Do not use it for confidential/private images or to bypass marketplace rules; handle account setup, API keys, and any purchases through a trusted first-party flow with explicit confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
94% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares no permissions, yet its documented behavior requires network access, file writes, environment-variable use, and file upload. This is dangerous because reviewers and runtime policy systems may underestimate what the skill can do, weakening consent, sandboxing, and audit controls around data exfiltration and external service access.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
A large behavior gap between the stated purpose and actual reachable capabilities is a serious trust and abuse issue. If the skill can trigger authentication, payments/orders, public uploads, or broader image-generation flows beyond simple image fission, a user may invoke it expecting a narrow transformation while the system performs materially riskier operations with credentials, billing, and data exposure.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The onboarding document adds account registration, SMS login, API key acquisition, and billing/purchase workflows that are outside the stated purpose of an image-fission skill. This expands the skill's effective privilege and data-handling scope to authentication, personal data collection, and payment enablement, creating unnecessary attack surface and increasing the chance an agent will perform sensitive actions unrelated to the user’s core task.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The document explicitly instructs the agent to collect a phone number, trigger SMS verification, perform login, and create payment orders, none of which are necessary for image generation itself. In an agent setting, these steps could lead to unauthorized handling of sensitive identifiers and commercial transactions, especially if invoked automatically when the gateway reports auth or billing errors.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file implements SMS login, account onboarding, API-key acquisition, subscription discovery, order creation, and payment-state querying, which are unrelated to the declared image-fission purpose. That mismatch is dangerous because it expands the skill into credential handling and financial operations users would not reasonably expect from an image-processing skill.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code can create orders and render payment QR codes to facilitate purchases directly from the skill. For an image-generation skill, embedded payment workflows are unjustified and increase the risk of unauthorized charging, social engineering, or hidden monetization.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script performs SMS-based login, token exchange, team selection, and API token generation, returning a usable API key to stdout. In the context of an image-fission skill, this is an unjustified credential-issuance flow that could be abused to harvest or mint long-lived access for downstream misuse.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The script is a generic uploader for arbitrary local files and returns publicly accessible OSS URLs, which is a clear capability mismatch with the declared image-fission purpose. In an agent setting, this creates a straightforward data-exfiltration primitive: sensitive local files can be uploaded and their public URLs exposed, especially because the tool accepts any file path and prints the resulting public link.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The implementation performs unrestricted public upload of user-specified local files during normal execution, with no constraint tying uploads to generated product images or to a controlled output directory. In the context of a skill advertised for image variation, this unjustified capability broadens the attack surface and can be abused to publish arbitrary local data to public storage.

Vague Triggers

Medium
Confidence
78% confidence
Finding
Allowing direct invocation on loosely defined 'user intent match' creates overbroad triggering that can cause the skill to run unexpectedly on ambiguous requests. In this skill, that raises the chance of unintended image upload, external API use, and generation actions without sufficiently explicit user confirmation.

Missing User Warnings

High
Confidence
95% confidence
Finding
The workflow converts local images into publicly accessible URLs, but the skill does not clearly warn users that their images may become internet-accessible. This is dangerous because product images can contain sensitive business assets, embedded personal data, unpublished marketing material, or metadata, and making them public materially increases leakage and downstream reuse risks.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The workflow explicitly states that generated images will be written to a session directory, but it provides no user-facing notice, consent step, retention policy, or storage boundary. Because the skill processes user-supplied commercial images and produces derivative assets intended to evade platform duplicate-detection, silent persistence increases privacy, compliance, and data-handling risk if files are retained, exposed to other sessions, or reused unexpectedly.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are broad enough to match routine requests like 'generate image' or '帮我画', which can cause the skill to activate in contexts where the user did not specifically intend to send images or prompts to this external service. In this skill, automatic execution is especially risky because the document also instructs immediate script invocation and network use, increasing the chance of unintended data transmission and file creation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill describes automatic downloading of generated images and silent persistence of full API responses, including temporary URLs and task metadata, but does not present a clear user-facing warning that provided images will be transmitted to a third-party service and that artifacts will be stored locally. This creates privacy and data-handling risk, especially for sensitive product images, customer media, or proprietary assets.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The API reference explicitly instructs clients to send reference image URLs and free-form prompts to an external image-generation service, but it provides no warning about data sensitivity, third-party processing, or consent requirements. In this skill’s context, users may upload product images that contain proprietary assets, embedded personal data, or marketplace-identifying metadata, so silent transmission to an external service creates a real privacy and confidentiality risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script writes full raw API responses to session storage even on failure, without explicit user-facing consent or minimization. Those responses may contain task metadata, generated asset URLs, member identifiers, or other operational data that can persist locally and be exposed to other users, processes, or later collection workflows.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Downloaded media from remote URLs is silently persisted under the session directory. In this skill context, the files are product images and generated derivatives, which may be commercially sensitive or linkable to account activity; undisclosed local storage increases privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The login flow returns a freshly obtained API key in normal command output without an in-band warning, masking, or secure storage guidance. In agent environments, stdout is commonly logged, captured, or surfaced to other components, so this can leak a sensitive credential beyond the intended user.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation text is extremely broad: it triggers not only on explicit upload requests but on any situation where a URL is needed or a local artifact exists. Because this skill publishes files to a publicly accessible OSS URL, overbroad routing can cause unintended disclosure of locally generated reports, images, CSVs, or other artifacts when the user did not clearly consent to public upload.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly states that uploaded files become publicly accessible via an HTTPS URL and that those URLs are recorded in session metadata, but it does not warn users about confidentiality, persistence, or downstream exposure risks. In a file-upload skill, this omission can cause operators or users to upload sensitive images or business data under the false assumption that storage is private or transient.

Ssd 4

Medium
Confidence
94% confidence
Finding
The skill is explicitly designed to keep the product unchanged while altering images to evade platform duplicate-detection and anti-association controls. That makes the abuse context more dangerous: it facilitates circumvention of marketplace integrity mechanisms, enabling deceptive multi-store operations and potentially policy-evasion at scale.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
89% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.