跨境电商带货口播专家

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:49 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed LinkFox product-video workflow, but it needs Review because it handles account/API-key/payment flows and contains mandatory race-based generation rules.

Review before installing. Only use this skill if you trust LinkFox with product images, prompts, generated media, API keys, and any phone/SMS or billing flow. Avoid setting LINKFOX_* endpoint override variables unless you fully control the destination, and review the region-to-race prompt rules before using it in production.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (48)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The POST target is derived from environment-controlled base URLs, and the request can include sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and account metadata. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or manipulate onboarding flows.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway URL is also built from environment-controlled base settings and then used in outbound authenticated requests via urlopen. Because these calls carry the user's API key in the Authorization header and can create orders, query account state, and access billing-related data, endpoint redirection would expose secrets and enable unauthorized account operations.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, and the request can carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and headers containing authorization material. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to an attacker-controlled server and exfiltrate credentials and session data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request target is also built from environment-controlled base URLs and is used with an Authorization header populated from API keys. A hostile runtime or wrapper can redirect billing, account, and order traffic to an attacker endpoint, exposing API keys and enabling unauthorized account or payment workflow abuse.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST target is ultimately derived from environment-controlled base URLs, and this request can carry sensitive login material, access tokens, and API-token generation traffic. In a skill runtime where environment variables may be influenced by the host or deployment, this creates an SSRF/exfiltration path that can silently redirect credentials to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway URL is built from environment-derived base configuration and used with an Authorization header containing the API key. If an attacker can influence those variables, the CLI will transmit the bearer credential and billing/order traffic to an arbitrary server, enabling credential theft and abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation describes capabilities that imply environment access, file writes, and network operations, yet no explicit permissions are declared. This creates a hidden-privilege problem: reviewers and runtime policy engines may underestimate what the skill can access, weakening least-privilege controls and auditability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated purpose is a product talking-head video generator, but the behavior includes account login via SMS, API key acquisition, payment/order operations, media download, and multiple backend API calls that are far broader than the declared function. This mismatch is dangerous because it can conceal sensitive actions from users and reviewers, enabling credential handling, billing side effects, and external communications under the guise of simple content generation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly forces race/ethnicity selection from sales region and even excludes certain ethnic appearances, which introduces discriminatory generation logic unrelated to the legitimate function of creating sale videos. This can produce biased, exclusionary, or policy-violating outputs at scale, especially because the rule is mandatory and overrides user context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The referenced API documentation is for a different skill (`linkfox-aigc-textgen`) than the declared video-generation sale skill, creating a strong risk of capability confusion and unintended tool use. In practice, this can cause the agent to send user inputs, media URLs, or follow-up actions to the wrong backend, producing unauthorized data flows, incorrect outputs, or misuse of an unrelated service.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The Feedback API introduces a separate external reporting channel unrelated to the core described function of generating sale videos. Because it accepts free-form `content` and uses a different base URL, it creates an additional exfiltration path for user or conversation data that may be triggered without clear necessity or user awareness.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This onboarding document introduces authentication recovery, phone-based registration, API key acquisition, and billing/payment workflows that are outside the declared purpose of a video-generation skill. That scope expansion is dangerous because it can cause the agent to solicit sensitive data, drive account creation, and facilitate purchases under the guise of unrelated functionality, increasing phishing, privacy, and unauthorized transaction risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The instructions explicitly tell the agent to collect a phone number, send a verification code, log in, retrieve an API key, and assist with purchase flows. In the context of a video-generation skill, these capabilities are unjustified and materially increase the chance of sensitive credential handling, account takeover assistance, or social-engineering abuse if the skill is triggered unexpectedly or maliciously repurposed.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The code implements asynchronous text generation and content extraction, while the declared skill is for generating MP4 talking-head sales videos from product assets. This capability mismatch is dangerous because it can cause the agent to invoke a tool under false pretenses, leading to unintended data disclosure to a remote text service and breaking security assumptions about what the skill is permitted to do.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script contains a generic remote media download primitive unrelated to the file's text-generation purpose and also inconsistent with the advertised video-sale skill. Unnecessary network-capable utilities expand the attack surface and can be abused by future code paths or indirect callers to fetch attacker-controlled resources, including internal endpoints if not constrained.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS login, API key issuance, and billing workflows that do not match the declared purpose of a video-generation skill. That scope mismatch is dangerous because users invoking a media-generation skill would not reasonably expect credential collection, account provisioning, or payment operations, increasing the risk of deceptive token harvesting and unauthorized commercial actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code creates paid orders and renders payment QR codes, which is unrelated to the advertised video-generation functionality. In this skill context, hidden billing logic is especially risky because it can pressure or trick users into purchases under the guise of producing marketing videos.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file retrieves or generates a user's platform API token and returns it to stdout, which is a powerful account-provisioning capability outside the manifest's stated scope. In a video-generation skill, undisclosed token issuance materially increases the chance of credential theft, privilege expansion, and abuse of the user's account outside the immediate task.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The document expands a video-generation skill into authentication recovery, account registration, API-key setup, and billing workflows that are outside the declared scope. This broadens the agent's authority and creates unnecessary access to identity, credential, and payment-related operations, increasing the chance of abuse or accidental mishandling.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: These instructions explicitly authorize collecting a user's phone number and using it to trigger registration/login commands against an external service, despite that capability being unrelated to producing marketing videos. Handling phone numbers and one-time codes introduces sensitive personal-data and account-access risk, especially without clear consent, identity verification, or data-handling constraints.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documentation instructs the agent to guide plan selection, create payment orders, and present payment URLs/QR codes, which are payment-processing actions unrelated to the skill's stated video-generation purpose. This creates a path for financial manipulation, unintended purchases, or social-engineering abuse under the guise of routine skill use.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script implements multi-reference-image video generation, while the provided skill metadata describes a sales talking-head video generator. This capability mismatch is dangerous because users, reviewers, and policy controls may rely on the manifest to understand what data is processed and what external operations occur; mismatches reduce transparency and can hide broader functionality.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The code downloads generated media from remote URLs and persists files into local session storage, but the skill description only frames the tool as generating a deliverable video. Undisclosed persistence increases privacy and data-retention risk because user-related media and API outputs remain on disk beyond the immediate task.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements SMS login, API key acquisition, account inspection, subscription discovery, ordering, and payment QR generation, which are materially outside the stated purpose of a product video generation skill. That scope expansion increases the attack surface and conditions users to provide credentials and complete purchases through a skill that should not need billing or account bootstrap logic.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders, query payment state, and render payment QR codes, which introduces monetization and transactional behavior unrelated to video assembly. In the context of this skill, that is dangerous because users may be induced to authorize payments or expose account-linked tokens under the guise of generating marketing videos.

Static analysis

No suspicious patterns detected.