全品类铺货专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 4:57 AM UTC
• Version: 1.0.1

Overview

The skill’s Amazon product-scouting workflow is mostly understandable, but it bundles broader account, scheduling, upload, feedback, and agent-instruction modification capabilities that deserve manual review before installation.

Review this before installing. It can call LinkFox/SellerSprite with your API key, save product data locally, create scheduled agent tasks, and includes bundled tools for account/payment onboarding, public file upload, feedback reporting, and modifying other agents’ CLAUDE.md files. Only install it in a workspace where those broader capabilities are acceptable, and avoid using the CLAUDE.md patching or public upload features unless you explicitly intend them.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (60)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 90% confidence
• Finding: The script launches another Python script via subprocess during normal operation. While subprocess.run is used with an argument list rather than a shell, the executed target comes from mutable configuration and the child process is trusted to return a file path, so this creates a real code-execution boundary with insufficient trust controls.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 96% confidence
• Finding: The subprocess working directory is derived from ACPX_WORKSPACES in the environment, so an attacker who can influence environment variables can redirect execution context and affect module resolution, relative file access, and which resources the child script loads. In an agent skill, this is more dangerous because skills often run in shared automation environments where environment data may be externally influenced.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 81, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 99% confidence
• Finding: SKILL_SCRIPT is taken from the SELLERSPRITE_SCRIPT environment variable and then executed with the Python interpreter. This allows arbitrary script execution if the environment can be modified, which is well beyond the stated product-scouting purpose and becomes effectively arbitrary code execution under the skill's privileges.

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The script reads sensitive values from environment variables, including the API key and session-related identifiers, and sends them in HTTP headers on every outbound request. Even though this appears to be intended service integration rather than overtly malicious behavior, it creates a real secret-exposure channel to a remote endpoint selected by configuration, which is risky in a skill whose stated purpose does not clearly disclose credentialed outbound access.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The POST target is derived from helper functions that read environment variables for base URLs, and the request may include sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and identifying headers. If an attacker can influence these environment variables, the script can be redirected to an attacker-controlled endpoint, causing credential and token exfiltration via SSRF-like outbound requests.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 88% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and then fetched with urlopen using the Authorization header populated from the API key environment variable. An attacker who controls the environment can redirect these authenticated requests to a malicious server and capture the API key and related account/order data.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request destination and outbound headers are influenced by environment variables: LINKFOX_TOOL_GATEWAY controls the base URL, and SESSION_ID/MODE_ID/APP_NAME plus the API key are sent in the request. In an agent or untrusted execution environment, an attacker who can set environment variables can redirect the POST to an attacker-controlled host and exfiltrate credentials and request metadata.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to execute shell commands, read/write files, call other skills/services, and handle networked workflows, yet it declares no permissions. This breaks least-privilege expectations and can cause the runtime or reviewers to underestimate the skill’s effective authority, especially because the workflow includes file export, scheduler integration, and external script execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose is product scouting, but the analyzed behavior set includes materially broader capabilities such as modifying other agents’ CLAUDE.md files, onboarding/payment flows, file upload, scheduler management, and HTML report generation. This kind of scope mismatch is dangerous because users and reviewers may trust the skill for a narrow shopping-analysis task while it can perform unrelated high-impact operations affecting other agents, files, or external services.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This script modifies local agent instruction files (CLAUDE.md) to inject new behavior, even though the skill is presented as an Amazon scouting/listing-selection expert rather than a workspace-modification utility. That mismatch is dangerous because it gives the skill hidden persistence and the ability to alter downstream agent behavior outside the user’s expected task boundary.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The --all mode automatically enumerates /root/.linkfox/workspaces/agents and bulk-patches every CLAUDE.md it finds, enabling broad unauthorized changes across the workspace. In the context of a product-selection skill, this is especially risky because it expands from a narrow business function into mass modification of agent instructions, potentially affecting many agents persistently and without granular consent.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The module includes generic file-upload capability to remote OSS storage, which expands the skill's data egress surface beyond local path management for product scouting. In an agent setting, such reusable upload primitives can be misused to transmit arbitrary local artifacts if higher-level controls are weak.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly supports overriding the executed external script path via an environment variable. That design creates a built-in arbitrary execution hook not required for ordinary product discovery and is especially risky in automation platforms where operators, wrappers, or other components can inject environment settings.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file documents APIs for a different skill (`linkfox-aigc-textgen`) than the declared skill purpose (`linkfox-expert-all-category-listing-scout`). This kind of cross-skill reference can cause an agent to invoke unrelated text-generation capabilities, broadening permissions and behavior beyond the user-expected listing-scout scope; in the worst case it enables unintended data flow to another backend and breaks security boundaries based on skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The feedback endpoint is unrelated to the stated listing-scout purpose and sends externally hosted data to `https://skill-api.linkfox.com/api/v1/public/feedback`. Even though the example payload looks harmless, an agent could repurpose this endpoint to exfiltrate user content, tool outputs, or behavioral data under the guise of feedback, which is more suspicious in a skill whose main function is product/listing scouting rather than user telemetry submission.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file documents authentication, registration, and billing workflows that are not aligned with the stated Amazon listing-selection purpose of the skill. This kind of capability mismatch is dangerous because it expands the skill's operational scope into account onboarding and payments, increasing the chance of credential handling, user confusion, and abuse of the agent to collect sensitive data outside its expected function.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The instructions direct the operator to help users register by phone number and purchase paid plans, which are sensitive account and payment actions unrelated to the advertised business function. This is dangerous because it normalizes collection of personal data and transaction initiation through a skill that users would not reasonably expect to perform onboarding or monetization tasks, creating phishing and unauthorized-purchase risk.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The implemented behavior is a generic AI text-generation client with async polling, which does not match the advertised Amazon all-category listing scouting and product-opportunity selection function. This mismatch is dangerous because users and orchestrators may grant the skill trust or permissions under false assumptions, increasing the chance of unintended data handling and hidden outbound processing.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The file contains a generic media-downloading helper unrelated to the advertised product-listing scouting use case and unused by the main text-generation path. Dormant, unrelated network-capable code increases attack surface and can later be invoked or repurposed for unintended fetching of attacker-controlled URLs.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements phone-based login, token acquisition, user/account inspection, and onboarding flows that are materially different from the advertised product-selection/listing-scout purpose. This mismatch is dangerous because users or host systems may grant permissions and trust based on the manifest, while the skill actually collects credentials and provisions API access.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can list purchasable plans, create orders, generate payment QR codes, and query payment status, which introduces monetization and transaction capabilities unrelated to the stated listing/selection function. In a mismatched skill context, this can lead to unauthorized or deceptive purchase flows and expands the blast radius from data access to direct financial actions.

Description-Behavior Mismatch

High

• Confidence: 87% confidence
• Finding: The script injects largely untrusted HTML content directly into a template and also extracts and reinserts script bodies from ECHARTS_SCRIPTS and CANVAS_SCRIPTS blocks with only minimal tag stripping. If an attacker can influence the input fragment, they can produce an output HTML report containing active JavaScript, leading to stored XSS or execution of arbitrary script when the report is opened.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill adds automatic Feedback API reporting that is outside its stated purpose of Amazon product search and filtering. This creates an undeclared secondary data flow that may transmit user content, task details, or sentiment to another endpoint without explicit user awareness or need for the core function.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatic user-feedback reporting is not necessary to fulfill the skill's product-search function, so it expands data processing beyond least-privilege and purpose limitation. If triggered on praise, dissatisfaction, or inferred improvement opportunities, it can silently exfiltrate user interaction metadata or content to a separate service.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The document adds a separate feedback-posting API that is unrelated to the core product-search capability, creating an unexpected secondary data flow. In an agent setting, this can cause user content, workflow details, or operational metadata to be transmitted to another external service without clear necessity, review, or user awareness.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57