Security audit
Security checks for vulnerabilities and agentic risk
The skill largely matches a video-replication workflow, but it has review-worthy risks around credential-bearing network calls, arbitrary URL fetching, public uploads, and bundled onboarding/payment capabilities.
Review this before installing if you will run it with real LinkFox credentials or private media. Use only trusted reference-video and product-image URLs, avoid setting endpoint override environment variables unless you control the destination, expect frames/uploads to become publicly accessible URLs, and install dependencies in an isolated environment with pinned versions where possible. Do not use the onboarding or payment commands unless you intend to log in, create an API key, or start a payment order.
skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:73Configurable Network Endpoints Permit Credential and Personal-Data Exfiltration
scripts/extract_video_frames.py:24Reference-Video Downloader Permits Server-Side Request Forgery and Public Data Exposure
skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:324Undocumented Agent and Session Metadata Is Transmitted with Every Generation Request
scripts/extract_video_frames.py:35Downloaded Reference Videos Persist in Temporary Storage
skills/linkfox-file-upload/SKILL.md:32Unpinned Runtime Dependency Installation Creates Supply-Chain Risk
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
try:
with _lf_urlopen(req, timeout=timeout) as resp:
if guessed_ext == "bin":
ct = resp.headers.get("Content-Type", "")
if "mp4" in ct:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}
req = Request(url, data=data, headers=headers, method="POST")
try:
with urlopen(req, timeout=HTTP_TIMEOUT) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""
The code allows API base URLs to be overridden by environment variables and then uses them for authenticated requests via requests.post. Because these requests carry SMS-login tokens, refresh tokens, API-token generation flows, and related identifiers, a poisoned environment can redirect sensitive credentials to an attacker-controlled endpoint, creating a clear exfiltration path.
except RuntimeError as e:
return {"_error": str(e)}
try:
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
return r.json()
except Exception as e:
body_text = ""
The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header set to the LinkFox API key. An attacker who can influence the runtime environment can reroute these requests to a malicious server and capture the API key and account/order metadata.
headers["Content-Type"] = "application/json"
req = Request(url, method=method, data=body_bytes, headers=headers)
try:
with urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode())
except urllib.error.HTTPError as e:
status = e.code
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
try:
with _lf_urlopen(req, timeout=timeout) as resp:
if guessed_ext == "bin":
ct = resp.headers.get("Content-Type", "")
if "mp4" in ct:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}
req = Request(url, data=data, headers=headers, method="POST")
try:
with urlopen(req, timeout=150) as response:
return json.loads(response.read().decode("utf-8"))
except HTTPError as e:
body = e.read().decode("utf-8") if e.fp else ""
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
except RuntimeError as e:
return {"_error": str(e)}
try:
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
return r.json()
except Exception as e:
body_text = ""
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers["Content-Type"] = "application/json"
req = Request(url, method=method, data=body_bytes, headers=headers)
try:
with urlopen(req, timeout=30) as resp:
return json.loads(resp.read().decode())
except urllib.error.HTTPError as e:
status = e.code
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers={"Content-Type": "application/json", "Authorization": api_token},
)
try:
with urlopen(req, timeout=30) as resp:
body = json.loads(resp.read().decode())
break
except urllib.error.HTTPError as e:
download_media() accepts an arbitrary url and fetches it with urlopen after only checking for http:// or https://. This enables server-side request forgery (SSRF): an attacker controlling the URL can make the runtime contact internal services, cloud metadata endpoints, or other sensitive network locations, and then persist the response to local session storage.
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
try:
with urlopen(req, timeout=timeout) as resp:
# 从 Content-Type 进一步修正扩展名
if guessed_ext == "bin":
ct = resp.headers.get("Content-Type", "")
声明描述的是一个面向短视频复刻的多步骤 AIGC 工作流，核心应涉及参考视频解析、商品素材替换、视频 prompt 生成以及下游视频生成调用。实际代码仅实现了对文本生成异步 API 的封装：读取 JSON 参数、发起任务、轮询状态、提取 content、对换行做占位编码，并在结果过大时写入本地文件。代码中没有任何与视频、图像、镜头、商品素材、模板复刻、TikTok 广告结构分析相关的处理，也没有下载/解析参考视频、分析图像内容、构造视频 prompt 或调用视频生成 skill 的逻辑。该差异属于主要目的和能力的实质性不一致，因此应判定为 mismatch。
声明描述的是 AIGC 视频复刻/短视频生成工作流；但代码完全没有任何视频解析、商品图分析、分镜拆解、prompt 生成、视频生成委托等逻辑。相反，代码专注于 LinkFox 平台的账号注册登录、鉴权、团队信息获取、套餐购买和支付流程，且会访问登录、用户中心、订单、支付相关接口。这属于与声明主目的显著不同的能力，并且包含多个未声明的敏感账户与支付相关操作，因此应判定为明显不匹配。
声明描述的是一个高层业务技能：输入参考爆款视频和商品素材，先理解并重构原视频结构，再生成用于复刻的 prompt，最终产出同款带货短视频。相比之下，代码只实现了一个底层异步视频生成客户端，核心行为是向固定接口提交参数、轮询任务状态、下载结果文件并保存到本地 session 目录。代码没有出现任何视频解析、镜头拆解、脚本/分镜提取、商品替换映射、prompt 构造、模板套用或“爆款复刻”相关判定逻辑。甚至从接口名看，主要能力是 multiImageVideoGenAsync（多图生视频），与声明中的“参考爆款视频做同款”存在明显用途差异。因此该描述与代码实际行为存在实质性不匹配。
声明描述的是视频复刻与视频生成工作流；但代码完全没有处理视频、图片、分镜分析、prompt 生成或调用视频生成模型/技能的逻辑。相反，它连接的是 LinkFox 的登录、账户、团队、套餐和支付接口，核心用途是账号登录与商业开通/onboarding。其主要资源访问对象是用户手机号、验证码、访问令牌、API key、订单和支付信息，这与声明中的媒体处理用途明显不一致。因此这是显著的描述-行为不匹配。
There is a clear and material mismatch. The declared description says this skill should replicate viral product videos by analyzing a reference video and product materials, producing a replacement video prompt, and delegating to a video-generation capability. The actual code does none of that. Instead, it solely handles local file upload to OSS via temporary STS credentials, printing JSON results and public URLs. This is not a supporting detail of the declared behavior; it is an entirely different primary function with different resource access patterns (local filesystem, credential retrieval, cloud object storage). Therefore the description does not accurately represent the code chunk.
声明描述的是一个面向短视频复刻创作的高层业务技能；而提供的代码块仅实现底层文件管理与媒体传输辅助功能。其主要职责是路径解析、会话元数据维护、OSS 上传、远程媒体下载和文本换行处理，属于通用基础设施代码，而非视频复刻业务逻辑。虽然这类工具可能被某个视频复刻 skill 间接使用，但就该代码块本身而言，实际行为与声明的核心目的明显不一致，因此应判定为描述与行为不匹配。
The trigger phrases are broad enough to match common requests such as generic writing, image recognition, and video analysis, which can cause this skill to activate in many unrelated contexts. Over-broad routing increases the chance that user prompts, images, or videos are sent to external services unexpectedly, and in this case may also cascade into downstream tool use because the skill embeds auto-chaining rules.
The referenced API document describes a generic text-generation service while the declared skill is a viral video replication skill. This mismatch can cause the agent to invoke the wrong capability, send user media/prompts to an unrelated backend, or produce outputs outside the user’s expected scope, creating both security and privacy risk through capability confusion.
The file implements a generic async text-generation client, while the skill metadata claims a viral video replication workflow. This capability mismatch is dangerous because policy, review, and routing decisions may trust the manifest description, yet the actual code can be invoked for broader text generation behavior than expected, undermining least privilege and security review assumptions.
The file’s documented purpose is an account/environment onboarding CLI, not a viral-video replication implementation. This capability mismatch is dangerous because users, reviewers, or orchestration systems may grant trust based on the manifest while the code actually handles authentication, API keys, plans, and payments.
This file implements package listing, order creation, payment QR rendering, and order-status querying, which are unrelated to the declared viral-video replication skill. Hidden commerce capabilities materially expand the attack surface and can cause unauthorized billing or deceptive monetization behavior in a context where users would not expect payment operations.
The code performs SMS login, token exchange, group discovery, and API-key issuance despite the skill being described as a video-generation workflow. Collecting phone numbers and verification codes and then minting API credentials is highly sensitive account functionality that is out of scope for the declared purpose and increases the risk of credential abuse or phishing-like behavior.
The referenced API documentation describes a different skill (linkfox-aigc-videogen-multi) than the declared viral-video-replication skill, creating a capability/intent mismatch. In an agent setting, this can cause the system to invoke the wrong tool, send the wrong modality of user data, or bypass expected safeguards tied to the actual skill behavior.
The documented input surface accepts imageList, while the skill claims to replicate a reference video. This mismatch is dangerous because it obscures what user content is actually being processed and may lead the agent to decompose or substitute user video into images without clear consent, safety review, or correct policy handling.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
示 JSON 里的 phone/agreements
- 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
- 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
- Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
- macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
- Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
- 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可
**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG