多竞品分析专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Amazon competitor-analysis workflow, but it sends sensitive LinkFox credentials and onboarding tokens to environment-configurable endpoints without clear trust controls.

Install only if you trust the LinkFox service and your runtime environment. Do not set LINKFOX_TOOL_GATEWAY, LINKFOX_AGENT_API_URL, LINKFOX_LOGIN_API_URL, or LINKFOX_AGENT_USER_API_URL unless you fully trust the target host, because API keys and login tokens may be sent there. Treat uploaded files and generated report links as public, and use a clean virtual environment with pinned dependencies if possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-aba-intelligent-query/scripts/onboarding.py:70

Finding

Credential Exfiltration Through Unrestricted API Endpoint Overrides

Content

View full analysis

Vulnerability Details

File Location: skills/linkfox-aba-intelligent-query/scripts/onboarding.py:70-89, 209-222
Vulnerability Type: Credential-bearing requests to unvalidated, configurable destinations
Risk Level: High

Additional affected implementations include:

• skills/linkfox-aba-intelligent-query/scripts/aba_query.py:37-38, 62-71
• skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:74-75, 308-333
• skills/linkfox-amazon-product-detail/scripts/amazon_product_detail.py:37-38, 62-71
• skills/linkfox-amazon-reviews-list/scripts/amazon_reviews.py:47-48
• skills/linkfox-amazon-search/scripts/amazon_search.py:37-38
• skills/linkfox-amazon-search-by-image/scripts/amazon_search_by_image.py:37-38
• skills/linkfox-amazon-search-by-image/scripts/upload_image.py:21, 52-75
• skills/linkfox-keepa-product-request/scripts/keepa_product_detail.py:37-38
• skills/linkfox-sellersprite-traffic-keyword/scripts/sellersprite_traffic_keyword.py:37-38
• The duplicated scripts/onboarding.py files in the LinkFox API Skills
• skills/linkfox-file-upload/scripts/linkfox_paths.py:263-281

Representative vulnerable code:

python

def _env_base(name: str, default: str, *fallbacks: str) -> str:
    for n in (name, *fallbacks):
        v = os.environ.get(n)
        if v:
            return v.rstrip("/")
    return default.rstrip("/")


def _agent_base() -> str:
    return _env_base(
        "LINKFOX_AGENT_API_URL",
        "https://tool-gateway.linkfox.com",
        "LINKFOX_TOOL_GATEWAY",
    )


def _login_base() -> str:
    return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com")


def _agent_user_base() -> str:
    return _env_base(
        "LINKFOX_AGENT_USER_API_URL",
        "https://agent-api.linkfox.com",
    )


def _api_key() -> str:
    return (
        os.environ.get("LINKFOX_AGENT_API_KEY")
        or os.environ.get("LINKFOXAGENT_API_KEY")
     
...[truncated 4553 chars]

Remediation

View remediation

Remediation Suggestions

1. Implement a centralized endpoint validator that:
   • Requires https.
   • Rejects embedded credentials, fragments, and unexpected ports.
   • Compares normalized hostnames against an explicit allowlist.
   • Rejects IP literals, loopback, link-local, and private-network destinations unless an isolated development mode is explicitly enabled.
2. Allow production credentials only for exact approved hosts, such as the documented LinkFox API hosts.
3. Use separate test credentials for custom development endpoints.
4. Disable redirects for credential-bearing requests, or validate every redirect destination before following it.
5. Do not attach Authorization, access tokens, refresh tokens, or session metadata until destination validation succeeds.
6. Minimize metadata headers. Send SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME only where the server contract requires them.
7. Add automated tests covering malicious schemes, deceptive subdomains, user-information syntax, redirects, and private IP addresses.
8. Log only the validated hostname and never log authentication values or complete credential-bearing URLs.

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-amazon-search-by-image/scripts/upload_image.py:91

Finding

Public File Upload Uses Extension-Only Content Validation

Content

View full analysis

Vulnerability Details

File Location: skills/linkfox-amazon-search-by-image/scripts/upload_image.py:91-102, 123-151
Vulnerability Type: Insufficient file validation and public object exposure
Risk Level: Medium

Related generic upload behavior is present in:

• skills/linkfox-file-upload/scripts/file_upload.py:42-61
• skills/linkfox-file-upload/scripts/linkfox_paths.py:339-435

The image uploader reads the entire selected file and explicitly requests a public ACL:

python

def upload_file(presigned_url: str, file_path: str, content_type: str):
    """Upload the local file to the presigned OSS URL via HTTP PUT."""
    with open(file_path, "rb") as f:
        file_data = f.read()

    req = Request(
        presigned_url,
        data=file_data,
        headers={
            "Content-Type": content_type,
            "x-oss-object-acl": "public-read",
        },
        method="PUT",
    )

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(
                    f"Upload failed with status: {response.status}",
                    file=sys.stderr,
                )
                sys.exit(1)
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
        print(
            f"Upload failed: HTTP {e.code}: {e.reason}\n{body}",
            file=sys.stderr,
        )
        sys.exit(1)
    except URLError as e:
        print(
            f"Upload connection failed: {e.reason}",
            file=sys.stderr,
        )
        sys.exit(1)

Validation is based only on the filename extension:

python

file_path = sys.argv[1]

if not os.path.isfile(file_path):
    print(f"File not found: {file_path}", file=sys.stderr)
    sys.exit(1)

extension = os.path.splitext(file_path)[1].lstrip(".").lower()
content_type = CONTENT_TYPE_MAP.get(extensio
...[truncated 3749 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify file signatures and MIME types using a trusted content-detection library rather than relying on extensions.
2. Decode images with a maintained image library and reject malformed, truncated, or unsupported content.
3. Enforce a conservative local size limit before opening the file.
4. Stream uploads in bounded chunks instead of loading the complete file into memory.
5. Validate that presigned URLs:
   • Use HTTPS.
   • Resolve to an approved OSS hostname and bucket.
   • Do not contain embedded user-information.
   • Do not redirect to an unapproved destination.
6. Prefer private objects and return short-lived signed read URLs.
7. If public access is functionally required, display an explicit confirmation identifying the local file and explaining that anyone with the resulting URL may access it.
8. Use generated server-side object names and restrictive response headers, including Content-Disposition: attachment where appropriate.
9. Avoid returning or recording unnecessary absolute local paths in output metadata.

T08 · Insecure Dependencies

Warning

• Location: skills/linkfox-aba-intelligent-query/scripts/onboarding.py:166

Finding

Unpinned Runtime Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: skills/linkfox-aba-intelligent-query/scripts/onboarding.py:166, 186
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Equivalent installation guidance appears in the other duplicated onboarding scripts and in:

• skills/linkfox-file-upload/SKILL.md:32
• skills/linkfox-file-upload/references/api.md:60
• skills/linkfox-file-upload/scripts/linkfox_paths.py:367-369

Representative code:

python

def render_qr(content: str, out_dir: str) -> dict:
    try:
        import qrcode
    except ImportError:
        err = "Missing qrcode dependency; run: pip install qrcode pillow"
        print(f"{TAG} render_qr: {err}", file=sys.stderr)
        return {
            "png_path": None,
            "ascii_qr": None,
            "error": err,
        }

python

def _require_requests() -> None:
    if requests is None:
        raise RuntimeError(
            "Missing requests dependency; run: pip install requests"
        )

The OSS helper provides equivalent unpinned guidance:

python

try:
    import oss2
except ImportError:
    raise RuntimeError(
        "Missing oss2 dependency; run: pip install oss2"
    )

Technical Analysis

The project recommends installing qrcode, pillow, requests, and oss2 without version constraints, hashes, a lockfile, or a required trusted package index. The scripts do not automatically execute these installation commands, but users are directly instructed to run them when dependencies are missing.

An unpinned installation resolves to whatever package version the configured Python index serves at installation time. The resulting code may differ from what was reviewed and tested. This creates exposure to:

• Future upstream compromise.
• Malicious or misconfigured package mirrors.
• Dependency substitution through altered index configuration.

...[truncated 1435 chars]

Remediation

View remediation

Remediation Suggestions

1. Provide a version-controlled dependency manifest with exact versions.
2. Use a lockfile containing cryptographic hashes for all direct and transitive dependencies.
3. Recommend installation with hash enforcement, such as pip install --require-hashes.
4. Document and enforce a trusted package index.
5. Install dependencies in a dedicated virtual environment rather than the system interpreter.
6. Add automated dependency vulnerability scanning and scheduled update review.
7. Build and publish reproducible, signed artifacts where possible.
8. Replace free-form installation messages with references to the reviewed lockfile and installation procedure.

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (295)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request destination and headers are partially controlled by environment variables, notably LINKFOX_TOOL_GATEWAY and multiple session-identifying headers, and the code sends the API key in the Authorization header to whatever gateway URL is configured. If an attacker can influence the execution environment, they can redirect requests to an attacker-controlled server and exfiltrate credentials, query contents, and metadata.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/aba_query.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code allows service base URLs to be overridden via environment variables and then sends login data, access tokens, refresh tokens, and API-key related requests to those derived endpoints with no allowlist or hostname verification. In a skill context, an attacker who can influence the environment can redirect these requests to attacker-controlled infrastructure and capture credentials or issued API tokens.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway URL is also environment-controlled and is used for authenticated API calls carrying the user's API key in the Authorization header. If the environment is tampered with, the CLI can be induced to send the API key and billing/order traffic to an attacker-controlled endpoint, enabling credential theft and abuse.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The request forwards multiple environment-derived values, including an API key and session metadata, to a network endpoint whose base URL is controlled by the LINKFOX_TOOL_GATEWAY environment variable. If that variable is attacker-controlled, the script can exfiltrate credentials and internal identifiers to an arbitrary host, making the environment-to-network taint real in this case.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends login credentials, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints via requests.post. If an attacker can influence the environment, they can redirect these highly sensitive onboarding flows to a malicious server and exfiltrate secrets or impersonate the user.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway URL is also derived from environment variables and used in urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. A maliciously set LINKFOX_AGENT_API_URL or fallback value can redirect authenticated requests for account info, package listing, and order/payment actions to an attacker-controlled endpoint, leaking the API key and enabling phishing or fraudulent transaction setup.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The script sends multiple environment-derived values, including SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME, and the API key, to a remote endpoint, and the base URL itself can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. In an agent setting where environment values may be influenced by orchestration or untrusted workspace state, this creates a real exfiltration channel for sensitive metadata and credentials to an attacker-controlled server.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/amazon_product_detail.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence the runtime environment, they can redirect authentication traffic to attacker-controlled infrastructure and exfiltrate credentials and tokens.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway URL is also environment-controlled and is used for authenticated requests via urlopen with the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect account, package, and order requests to a malicious server and capture API credentials or manipulate responses.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 84, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The script builds outbound requests using environment-controlled configuration, including the gateway base URL and several metadata headers, then sends request data and authentication material to that destination. If an attacker can influence LINKFOX_TOOL_GATEWAY or the execution environment, they can redirect sensitive Amazon review queries, session identifiers, and API usage credentials to an attacker-controlled server, creating SSRF-style exfiltration and credential leakage risk.

Content

Scanner excerpt · skills/linkfox-amazon-reviews-list/scripts/amazon_reviews.py (reported line 91)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=timeout) as response:
            result = _parse_api_response(response.read(), path)
            cost_token = response.headers.get("X-Cost-Token")
            if isinstance(result, dict) and cost_token is not None:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script builds outbound request destinations from environment-controlled base URLs and then transmits sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and API keys, to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication traffic to attacker-controlled infrastructure and exfiltrate credentials without additional validation.

Content

Scanner excerpt · skills/linkfox-amazon-reviews-list/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway client sends authenticated requests using an API key in the Authorization header to a URL derived from environment variables. An attacker who controls those variables can redirect paid account, package, and order operations to a malicious server and capture bearer credentials or induce unintended transactions against spoofed services.

Content

Scanner excerpt · skills/linkfox-amazon-reviews-list/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The POST target URL is derived from environment-controlled base URLs, and the request includes sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In a skill/onboarding context, allowing untrusted environment variables to redirect authentication traffic can enable exfiltration of credentials to attacker-controlled endpoints via SSRF-like configuration abuse.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The gateway request URL is built from environment-controlled configuration and is used with an Authorization header carrying the API key. If an attacker can influence the runtime environment, they can redirect these authenticated requests to an external server and capture the bearer credential and business data.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/upload_image.py (reported line 74)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=150) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 58, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search-by-image/scripts/upload_image.py (reported line 107)May include surrounding context.

python

)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request sent via urlopen includes environment-derived values in headers, and the destination base URL is also overridable via the LINKFOX_TOOL_GATEWAY environment variable. That creates a real exfiltration risk: in a hostile or misconfigured runtime, secrets and identifiers such as the API key, session ID, and message metadata can be transmitted to an attacker-controlled endpoint.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/amazon_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

download_media() accepts an arbitrary caller-supplied URL and fetches it with urlopen after only checking for an http/https prefix. This creates a server-side request capability that can be abused for SSRF, unintended access to internal services, or downloading attacker-controlled content into session storage; in this skill context, arbitrary network fetches are broader than the stated Amazon competitor-analysis purpose, which increases risk.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The POST destination is derived from environment-controlled base URLs and is used to send login data, SMS verification flows, access tokens, and API-token generation requests. If an attacker can influence environment variables, they can redirect these sensitive requests to an attacker-controlled host and capture credentials or session material; the skill context increases risk because this file explicitly handles authentication and token issuance rather than ordinary competitor analysis.

Content

Scanner excerpt · skills/linkfox-keepa-product-request/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway request URL is built from environment-controlled configuration and then passed to urlopen with the API key in the Authorization header. An attacker who can set the base URL can exfiltrate the API key, manipulate order and account operations, or route requests to internal services, making this dangerous in a skill that performs billing and account actions unrelated to the advertised analysis purpose.

Content

Scanner excerpt · skills/linkfox-keepa-product-request/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

download_media fetches an arbitrary caller-supplied URL and writes the response to disk with no allowlist, DNS/IP validation, or private-address blocking. This enables SSRF against internal services or cloud metadata endpoints and can be used to persist attacker-controlled content locally, which is more dangerous in an agent environment that may have network reachability beyond the end user.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""