跨境电商爆款视频复刻专家

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:49 PM UTC
• Version: 1.0.0

Overview

The skill’s main video-replication workflow is mostly coherent, but the package also includes broad standalone generation skills plus account, API-key, and payment-order flows that deserve manual review before installation.

Install only if you are comfortable with LinkFox processing supplied videos, product images, extracted frames, prompts, and generated media through remote services, and with bundled onboarding scripts that can handle phone-based login, API-key retrieval, plan selection, and payment QR generation. Avoid using sensitive/private media, verify LINKFOX_* gateway environment variables before use, and require explicit user confirmation before any login, API-key, upload, or payment action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (37)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used to send login data, access tokens, refresh tokens, and related headers. In a skill/runtime environment where env vars can be influenced by a host, wrapper, or attacker, this enables exfiltration of credentials and user data to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and used with an Authorization header sourced from API-key environment variables. If the base URL is redirected to an attacker-controlled host, the CLI will transmit the bearer/API key and billing/account operations to that host.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and is used to transmit sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In a hostile or misconfigured runtime, an attacker can redirect these requests to an attacker-controlled endpoint, causing credential exfiltration and unauthorized account access.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request URL is built from environment-controlled configuration and used with an Authorization header carrying the API key. If the environment variable is poisoned, requests can be redirected to an attacker-controlled service, leaking the API key and enabling downstream abuse such as account queries, order actions, or other API operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions, yet its documented workflow includes shell/script execution, file writes, network access, and media processing. This creates a transparency and policy-enforcement gap: reviewers and runtime controls may assume a low-privilege skill while it orchestrates higher-risk capabilities such as downloading remote media, extracting frames, uploading files, and querying task artifacts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A description-behavior mismatch is dangerous because operators and users may authorize the skill for benign video replication while hidden or broader behaviors enable login/API-key acquisition, order/payment operations, and general-purpose upload/generation workflows. That significantly expands the attack surface and could permit unauthorized transactions, credential misuse, or data exfiltration under the cover of an unrelated media skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This onboarding document introduces account registration, login recovery, API-key setup, and payment purchase workflows that are unrelated to the stated purpose of a viral-video replication skill. That scope expansion is dangerous because it authorizes operators to handle credentials, identity data, and billing actions under the umbrella of an unrelated skill, increasing the chance of phishing, abuse, or unauthorized account operations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented ability to register accounts via phone verification and purchase plans is not justified by the business purpose of a video-replication skill. Embedding these actions in the skill normalizes collection of phone numbers, handling of verification codes, and initiation of payments, which could be misused for unauthorized account creation or billing fraud.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements asynchronous text generation, while the declared skill is for viral video replication. This capability mismatch is dangerous because it can mislead reviewers and orchestrators about what code will execute, undermining trust boundaries and allowing unintended functionality to run under an unrelated skill identity.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements account onboarding, SMS login, API-key retrieval, plan listing, and order/payment flows, which do not match the declared purpose of a viral video replication skill. Such scope mismatch is dangerous because users invoking a media-generation skill would not reasonably expect identity, token, and commerce actions, increasing the risk of deceptive credential and payment collection.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The code can create orders, fetch purchasable plans, and render payment QR codes despite the skill being described as a video replication tool. Unjustified billing capability inside an unrelated skill materially raises abuse risk, including unauthorized purchases, social engineering, and hidden monetization flows.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This reference file introduces account onboarding, authentication recovery, and billing/payment workflows that are outside the stated purpose of a video-replication skill. Expanding a content-generation skill into identity handling and payment orchestration increases attack surface and can mislead an agent into collecting credentials or facilitating purchases without clear product- or policy-level justification.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documented ability to register users by phone, log them in via SMS code, list plans, and create payment orders is materially unrelated to generating replicated product videos. In an agent setting, these capabilities can enable unauthorized account creation, payment manipulation, or sensitive workflow abuse if triggered by prompts or misrouted errors.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The implementation is a generic multi-image-to-video generator, but the declared skill is a narrowly scoped viral-video replication workflow. This mismatch weakens policy enforcement and can let callers invoke broader video-generation behavior than users or orchestrators expect, increasing the chance of unsafe or unauthorized use.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script accepts arbitrary JSON from argv and forwards it directly to the backend with no schema validation, scope restriction, or allowlist of permitted parameters. In this skill context, that makes the capability broader than advertised and enables misuse of the backend API for unintended generation tasks or parameter injection beyond the replication use case.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: This skill file implements account onboarding, SMS login, API key issuance, package discovery, ordering, and payment flows that are not inherent to a viral-video replication function. Such overprivileged and out-of-scope capabilities increase attack surface and can surprise users by handling identity, billing, and credential operations in a content-generation skill.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The code can create orders, determine team billing context, and render payment QR codes, which are sensitive commerce actions unrelated to the advertised video-remix purpose. In a skill ecosystem, bundling payment initiation into an unrelated skill raises the risk of deceptive purchase flows, abuse of stored credentials, and unintended charges.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs processing user-supplied video and image URLs through downstream analysis and upload components without a clear user-facing disclosure that their media may be fetched, transformed, uploaded, and stored externally. This is a privacy and data-handling risk, especially because reference videos and product assets may contain copyrighted, confidential, or personal content that users did not expect to leave the immediate system boundary.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The core trigger is broad enough that the skill may activate on loosely related requests and then proceed to replicate a third-party video's structure, subtitles, and presentation with minimal user constraint checks. In this context, overbroad activation increases the chance of unauthorized stylistic copying, misuse on copyrighted or misleading ad content, and execution under assumptions the user did not explicitly approve.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The boundary example says to replicate the original video's pacing and on-screen text, auto-trim or compress if needed, and skip an intermediate report, but it does not define limits or validation steps. That ambiguity can cause the skill to bypass review, perform substantial copying from reference media, and proceed without confirming whether compression, truncation, or subtitle reuse is acceptable.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The prompt hard-codes US as the sales region and English as the target language instead of deriving them from user intent or requiring consent. This can silently override user preferences, produce misleading market-specific content, and create compliance or suitability issues when the generated ad is used in a different jurisdiction or language context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document specifies sending user-provided video URLs, product images, and extracted frames to multiple underlying services, including a file-upload capability, but does not indicate any user notice, consent, or data-handling boundary. This creates a real privacy and data-governance risk because users may supply third-party or sensitive media without realizing it will be uploaded, transformed, and shared across backend components.

Missing User Warnings

Low

• Confidence: 70% confidence
• Finding: When given a remote URL, the script silently downloads the full source video to a temporary file and later prints the local path in JSON output. In a media-processing skill handling user or third-party content, undisclosed local persistence can create privacy, retention, and operational risk, especially if temp files are not cleaned up after use.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger list includes broad phrases like “帮我写一段”, “图片识别”, and “视频分析”, which are common requests that can match many unrelated user intents. This can cause unintended skill activation, leading to prompts, images, or video URLs being routed to this remote text-generation service instead of the intended tool, creating both privacy and workflow integrity risks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documentation states that prompts and image/video URLs are accepted and processed, but it does not clearly warn that these inputs are sent to an external model service. Users may unknowingly provide sensitive text or private media links, resulting in unintended third-party disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.