Back to skill

Security audit

Alexa 提示词选品专家

Security checks across malware telemetry and agentic risk

Overview

This skill mostly supports LinkFox product research, but it bundles sensitive account, billing, scheduling, upload, and cross-skill behaviors that are broader than the top-level purpose makes clear.

Install only if you expect a broad LinkFox automation bundle, not just an Alexa prompt helper. Review the account login, API key, billing/order, scheduler, public upload, and feedback behaviors first; avoid setting endpoint override environment variables unless you control the destination, and avoid uploading or scheduling sensitive content without explicit intent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (63)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
93% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
92% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill text prescribes capabilities that imply environment access, file read/write, and networked tool use, yet no declared permissions are present. That gap weakens governance and informed review because operators and users cannot clearly see what privileged actions the skill may trigger, including report generation and external service calls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior extends far beyond Alexa product-selection prompting into authentication, API key handling, payments/orders, generic AI generation, file upload, HTML report writing, and task scheduling. This description-behavior mismatch is dangerous because it hides materially different trust boundaries and can cause users or reviewers to authorize a marketing-analysis skill that also performs account, billing, persistence, and external upload actions.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
Including an instruction to invoke `expert-skill-creator` introduces an unrelated skill-authoring capability into a product research skill. That expands the attack surface by enabling cross-skill creation or modification workflows that are not necessary for the stated task and could be abused to plant or alter other skills.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is presented as a text-generation/analysis tool, but the documentation instructs agents to automatically chain its output into downstream image/video generation skills. This expands the effective privilege and data-flow of the skill beyond its declared scope, increasing the chance of unintended external calls, prompt injection propagation, and misuse of generated content as executable workflow input.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The document explicitly says image/video generation is out of scope, yet earlier sections require automatic downstream invocation of those exact skills. This contradiction is dangerous because operators or agents may rely on the later 'not applicable' statement while the embedded workflow actually causes hidden capability escalation and unexpected data transmission to other services.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The file documents authentication recovery, phone-based account registration, API key setup, and billing/payment flows that are unrelated to the stated Alexa product-selection research purpose of the skill. This scope expansion increases the chance that an agent using the skill will collect credentials or personal data and guide users into account/payment workflows that are not justified by the advertised functionality.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The markdown explicitly enables collecting a user's phone number, sending login codes, obtaining an API key, and initiating paid subscription orders. For a research/prompt-generation skill, these capabilities are unjustified and dangerous because they can drive an agent to perform identity-linked account actions and payment-related operations outside the user's reasonable expectations.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file’s behavior is materially unrelated to the declared Alexa product-selection research purpose and instead implements account onboarding, SMS authentication, API key acquisition, plan listing, ordering, and payment QR generation. This capability mismatch is dangerous because it can trick users or hosting platforms into running credential and payment workflows under the guise of a benign research skill.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code provisions accounts, generates API tokens, and creates/query purchase orders despite the skill being presented as an Alexa prompt research tool. In this context, those hidden operational capabilities materially increase risk because they enable credential collection and monetized actions unrelated to the expected user task.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The documentation adds a separate feedback submission API that is unrelated to the primary Alexa product-research function, creating an additional outbound data path that could be used to transmit user content to another external service. In a skill context, this increases privacy and scope-creep risk because agents may send user-derived summaries or conversation details without a clear necessity check, consent flow, or minimization guidance.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The module documentation explicitly states it must not write to /tmp and should fail if the current directory is not writable, but the implementation silently falls back to ~/linkfox and the system temporary directory. This can cause sensitive API responses to be persisted in less controlled locations than operators expect, increasing exposure through weaker permissions, shared temp storage, or missed cleanup.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements account onboarding, SMS verification, login, API-key acquisition, package listing, ordering, and payment QR generation, which are materially unrelated to the declared Alexa prompt product-selection research purpose. Such scope divergence is dangerous because it can be used to socially engineer users into submitting credentials and initiating billing operations under the guise of a research skill.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The code can create paid orders and render payment QR codes, enabling real billing actions from within a skill that is described as a research assistant. In this context, hidden commerce capabilities are especially risky because users may not expect the skill to initiate purchases, increasing the chance of deceptive charging or unauthorized financial actions.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill retrieves or generates API tokens for the user after SMS login, which materially expands access beyond the declared research purpose. Token issuance is sensitive because the resulting API key can enable persistent authenticated access to external services, turning a one-time login interaction into durable account compromise if mishandled or exfiltrated.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is presented as an Amazon product-detail lookup, but it also instructs the agent to automatically send user-interaction feedback to a separate Feedback API. This creates an unnecessary secondary data flow that can disclose user sentiments, task details, and behavioral metadata beyond the core function, violating data minimization and user-expectation boundaries.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Automatically reporting user satisfaction, dissatisfaction, or intent mismatch to a Feedback API is not necessary to fulfill ASIN detail retrieval. Because the trigger includes subjective user reactions and workflow observations, it can leak conversational context and user behavior that the user did not intend to share with a third-party endpoint.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The file documents an unrelated public feedback-submission endpoint alongside the Amazon product-detail tool API, creating a secondary network action path that is not necessary for the stated skill purpose. In an agent setting, this can enable unprompted or covert exfiltration of user content, conversation summaries, or operational metadata to an external service under the guise of 'feedback,' especially because the payload invites free-form content.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The file embeds account authentication and billing-recovery workflows inside a skill whose stated purpose is Amazon product-selection research. This expands the skill's operational scope into credential, account, and payment handling, creating unnecessary attack surface and increasing the chance the agent will solicit sensitive information or perform actions the user did not expect.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The instructions explicitly allow collecting a user's phone number, sending login codes, logging in, and initiating paid plan purchases, none of which are necessary for product-selection research. If followed by an agent, this can lead to unauthorized identity/account actions, exposure of personal data, and payment-related social engineering within an unrelated workflow.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The docstring promises that output is always confined to the current working directory and explicitly forbids writing to /tmp, but the actual implementation falls back to ~/linkfox and the system temp directory. This mismatch can cause sensitive API responses to be persisted in locations users and reviewers would not expect, increasing the chance of inadvertent disclosure on shared systems or less-protected temp storage.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This skill is described as a product-selection research expert, but the script performs account onboarding, SMS login, API key retrieval, and purchase operations. That scope expansion is dangerous because users or host systems may grant trust appropriate for research assistance while the code can actually authenticate accounts and obtain credentials for unrelated backend access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/linkfox-task-scheduler/references/api.md:57