Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent image-generation purpose, but it needs Review because it can execute job-supplied Python script paths and handles public uploads, credentials, and billing flows with weak scoping.
Review this carefully before installing. Use it only in a trusted environment, do not set custom LINKFOX_* gateway URLs unless you fully trust the endpoint, avoid passing untrusted job JSON files, and treat local file inputs as public once uploaded. Be cautious with the onboarding and billing commands: they handle SMS codes, API keys, and payment order creation, and the current docs expose/persist API keys in ways that should be improved.
skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:74Unchecked endpoint overrides can redirect credentials and sensitive request data
scripts/run_mannequin.py:148Job parameters permit execution of arbitrary local Python scripts
skills/linkfox-aigc-textgen/scripts/onboarding.py:484Onboarding exposes the complete reusable API key in plaintext output
skills/linkfox-file-upload/SKILL.md:32Documentation recommends installation of unpinned third-party dependencies
The script downloads arbitrary HTTP/HTTPS URLs from resultList and writes them to local storage without validating the destination host, size, or content beyond a loose scheme check. Because the gateway base URL is environment-controlled and the service response drives follow-on downloads, this creates an SSRF-style trust-boundary issue and can be abused to fetch unexpected internal or attacker-controlled content into the agent workspace.
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
try:
with _lf_urlopen(req, timeout=timeout) as resp:
if guessed_ext == "bin":
ct = resp.headers.get("Content-Type", "")
if "mp4" in ct:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}
req = Request(url, data=data, headers=headers, method="POST")
try:
with urlopen(req, timeout=150) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""
The code builds destination URLs from environment variables and then sends authentication material, SMS-login data, and token-management requests to those endpoints via requests.post. If an attacker can influence the environment, they can redirect these calls to attacker-controlled infrastructure and exfiltrate phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and payment-related data.
except RuntimeError as e:
return {"_error": str(e)}
try:
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
return r.json()
except Exception as e:
body_text = ""
The gateway URL is also derived from environment configuration and then used in urlopen with the Authorization header carrying the API key. An attacker who controls the environment can redirect gateway traffic and capture API keys, account metadata, package/order details, and influence billing or order-status flows.
headers["Content-Type"] = "application/json"
req = Request(url, method=method, data=body_bytes, headers=headers)
try:
with urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode())
except urllib.error.HTTPError as e:
status = e.code
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
try:
with _lf_urlopen(req, timeout=timeout) as resp:
if guessed_ext == "bin":
ct = resp.headers.get("Content-Type", "")
if "mp4" in ct:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}
req = Request(url, data=data, headers=headers, method="POST")
try:
with urlopen(req, timeout=HTTP_TIMEOUT) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""
The code builds outbound request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication and token traffic to attacker-controlled infrastructure and exfiltrate credentials.
except RuntimeError as e:
return {"_error": str(e)}
try:
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
return r.json()
except Exception as e:
body_text = ""
The gateway request path uses environment-derived base URLs with an Authorization header populated from LINKFOX_AGENT_API_KEY, causing secrets to be transmitted to whatever host the environment specifies. In a compromised or multi-tenant execution environment, this becomes a straightforward secret exfiltration channel.
headers["Content-Type"] = "application/json"
req = Request(url, method=method, data=body_bytes, headers=headers)
try:
with urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode())
except urllib.error.HTTPError as e:
status = e.code
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers={"Content-Type": "application/json", "Authorization": api_token},
)
try:
with urlopen(req, timeout=30) as resp:
body = json.loads(resp.read().decode())
break
except urllib.error.HTTPError as e:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
try:
with urlopen(req, timeout=timeout) as resp:
# 从 Content-Type 进一步修正扩展名
if guessed_ext == "bin":
ct = resp.headers.get("Content-Type", "")
The skill explicitly instructs the agent to upload any non-http/https local file path via a file-upload skill and convert it to a public URL. In context, that creates a data-exfiltration risk: if an agent is given an unintended local path, the skill provides a sanctioned path to publish local files externally without clear path restrictions, type validation, or user confirmation.
The skill explicitly instructs the agent to upload any non-http/https local file path via a file-upload skill and convert it to a public URL. In context, that creates a data-exfiltration risk: if an agent is given an unintended local path, the skill provides a sanctioned path to publish local files externally without clear path restrictions, type validation, or user confirmation.
The skill explicitly instructs the agent to upload any non-http/https local file path via a file-upload skill and convert it to a public URL. In context, that creates a data-exfiltration risk: if an agent is given an unintended local path, the skill provides a sanctioned path to publish local files externally without clear path restrictions, type validation, or user confirmation.
The skill explicitly instructs the agent to upload any non-http/https local file path via a file-upload skill and convert it to a public URL. In context, that creates a data-exfiltration risk: if an agent is given an unintended local path, the skill provides a sanctioned path to publish local files externally without clear path restrictions, type validation, or user confirmation.
The skill explicitly instructs the agent to upload any non-http/https local file path via a file-upload skill and convert it to a public URL. In context, that creates a data-exfiltration risk: if an agent is given an unintended local path, the skill provides a sanctioned path to publish local files externally without clear path restrictions, type validation, or user confirmation.
The skill explicitly instructs the agent to upload any non-http/https local file path via a file-upload skill and convert it to a public URL. In context, that creates a data-exfiltration risk: if an agent is given an unintended local path, the skill provides a sanctioned path to publish local files externally without clear path restrictions, type validation, or user confirmation.
The skill explicitly instructs immediate execution upon receiving arguments and forbids waiting for user confirmation, even though execution triggers external API requests, asynchronous polling, and persistence of generated files and raw responses. This removes an important safety checkpoint and increases the chance of unauthorized actions, unintended spending, privacy leaks via uploaded image URLs, and filesystem side effects.
This file implements account onboarding, SMS authentication, API-key issuance, plan listing, ordering, and payment support, which is materially broader than the stated mannequin-to-model image generation purpose. That scope mismatch increases the attack surface and can surprise users by introducing credential handling and billing capabilities where only image processing is expected.
The code can create orders and render payment QR codes, enabling direct billing actions from within a skill whose declared function is image transformation. In this context, embedded payment capability is dangerous because it expands consequences from image processing to unintended purchases and collection of transaction metadata.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
示 JSON 里的 phone/agreements
- 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
- 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
- Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
- macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
- Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
- 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可
**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
示 JSON 里的 phone/agreements
- 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
- 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
- Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
- macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
- Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
- 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可
**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG
The provided skill context describes mannequin-to-model image generation, but the file actually performs asynchronous text generation against /aigc/textGenAsync and /aigc/textTaskQuery. This mismatch is dangerous because it can cause reviewers, orchestrators, or users to approve or invoke a capability different from what is actually executed, enabling unintended data transmission and policy bypass.
This file implements account onboarding, SMS login, API key retrieval, plan listing, ordering, and payment QR generation, which is unrelated to the declared mannequin-to-model image generation purpose. Such capability mismatch is dangerous because it collects user credentials and enables account/payment operations under the cover of an unrelated skill, increasing the likelihood of deceptive data harvesting or unauthorized commercial actions.
The code can create orders, query order status, and render payment QR codes despite the skill being described as an image-processing tool. Embedding billing operations in an unrelated skill creates risk of unauthorized charges, deceptive upsell flows, and payment phishing, especially when users would not expect commerce behavior from this context.
The script performs SMS-based login and API key issuance, collecting authentication factors and account tokens unrelated to mannequin-to-model generation. In this skill context, that behavior is especially suspicious because it can capture credentials and mint reusable API access under misleading pretenses.