多竞品分析专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:36 AM UTC
• Version: 1.0.0

Overview

This skill fits an Amazon competitor-analysis workflow, but it adds automatic feedback reporting, remote skill-install guidance, public file upload paths, and broad local persistence that should be reviewed before use.

Install only if you are comfortable giving the skill a LinkFox API key, letting it call external LinkFox services, saving full product/review/keyword responses locally, and potentially uploading local images or files to public URLs. Review LINKFOX_TOOL_GATEWAY before use, avoid sensitive local images/files, and do not allow automatic onboarding downloads or feedback submissions unless you explicitly approve them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (74)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request sent via urlopen includes multiple headers populated directly from environment variables, and the destination host is also overrideable through LINKFOX_TOOL_GATEWAY. In an agent/runtime context, environment variables are often influenced by orchestration or untrusted configuration, so this enables exfiltration of session metadata and the API key to an attacker-controlled endpoint if the gateway variable is poisoned.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill orchestrates tools with effective capabilities equivalent to network access, local file read/write, and likely environment access, yet declares no permissions or trust boundaries. This creates a transparency and governance gap: users and the hosting platform cannot accurately assess what data the skill can access, transmit, or persist, increasing the risk of unauthorized exfiltration, unsafe file handling, or misuse of execution context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented purpose focuses on competitor analysis, but the actual behavior appears to include generic local file upload to OSS with public URLs and presigned upload flows, which materially expand the attack surface beyond what a user would reasonably expect. Even if some functions are related to image search or report generation, undeclared public-upload capability can expose sensitive local files, generated reports, or intermediate artifacts to unintended parties.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill is for ABA query/analysis, but it instructs the agent to download and install an additional skill package from a remote URL when onboarding material is missing. That expands scope from data querying into software acquisition and installation, creating a supply-chain risk and a path for unreviewed code or instructions to enter the environment.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The skill directs automatic feedback API reporting for broad categories such as praise, dissatisfaction, mismatch, or anything improvable, which can cause unsolicited transmission of user interaction data unrelated to the ABA query itself. This creates a data-governance and privacy risk because metadata or conversation content may be sent externally without necessity or explicit user awareness.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The docstring explicitly says writing to /tmp is forbidden and that non-writable current directories should cause an error, but the implementation silently falls back to home and temporary directories. This mismatch can cause sensitive ABA/API response data to be written to locations the operator did not expect, weakening data handling guarantees and making accidental disclosure more likely.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file documents APIs for a different skill (`linkfox-aigc-textgen`) than the declared Amazon competitor-analysis skill, creating a capability-to-purpose mismatch. In practice this can cause the agent to invoke unrelated remote text-generation and feedback endpoints, expanding data exposure and enabling unintended outbound actions beyond the user-expected scope.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The standalone feedback submission endpoint is not clearly necessary for competitor analysis and allows arbitrary free-form content to be sent to a separate external service. That creates an unnecessary exfiltration channel for user data, task contents, or internal observations if the agent auto-populates feedback without explicit user intent and consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to download and install another skill from a remote URL when onboarding content is missing, which expands behavior far beyond product-detail lookup into untrusted code acquisition. In an agent environment, this creates a supply-chain and prompt-expansion risk because a compromised or unexpected remote package could introduce new capabilities, data access, or unsafe instructions without clear user review.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill mandates out-of-band reporting to a separate Feedback API even though its stated purpose is product detail retrieval. This creates an undeclared secondary data flow that may transmit user interactions, task content, or environment-derived metadata to another service without a clear need for the requested task.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module docstring promises that output will only be written under the current working directory and explicitly forbids /tmp, but the implementation falls back to the home directory and temporary directory. This mismatch can cause sensitive API responses to be persisted in locations the operator did not expect, weakening data-handling guarantees and potentially exposing data to other local users or less protected storage.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to automatically call a separate Feedback API based on user sentiment or perceived improvement opportunities, which is unrelated to the core review-fetching function. This can cause unauthorized transmission of user interactions or metadata to another endpoint without explicit user consent, expanding data flow beyond the requested task.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill contains instructions to download and install another skill from an external URL when onboarding or billing issues occur. That introduces a software acquisition and execution path unrelated to the primary review task, creating supply-chain and prompt-scope expansion risk, especially if the external package changes or is unverified.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill expands from a simple image-search workflow into persistent local storage of complete API responses and optional full stdout emission. Those responses may contain user-supplied image URLs, marketplace selections, session identifiers, pricing data, or other sensitive workflow context, and writing them by default into the project directory increases the chance of unintended retention, indexing, or exfiltration by other tools.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to download and install another skill package from a remote URL when onboarding content is unavailable. Allowing runtime acquisition and installation of code or skill content from the network creates a supply-chain risk: a compromised remote archive, replaced package, or tampered dependency could introduce arbitrary malicious instructions into the agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill requires uploading a user-provided local image to obtain a public URL, which changes the trust boundary from local-only handling to external disclosure. If the image contains proprietary product assets, personal information, or confidential metadata, making it publicly accessible even temporarily can leak sensitive data and create unintended third-party access.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation is internally inconsistent: one section says local image files are not applicable, while another instructs uploading them for use. This contradiction can cause an agent to bypass intended scope limitations and invoke extra data-transfer behavior users did not anticipate, increasing privacy and misuse risk.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The boundary guidance conflicts with the local-image upload instructions, weakening operational safeguards around when the skill should or should not activate. In an agent setting, contradictory boundaries make it more likely the model will perform unintended uploads or broaden the task beyond the user's reasonable expectations.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file documents a public feedback submission endpoint that is separate from the Amazon image-search tool and unrelated to the stated competitor-analysis/search capability. Adding an unrelated write-capable endpoint expands the skill’s effective scope and creates a channel for transmitting user-derived content to a third party, which can be abused for unsolicited data exfiltration, spam, or covert telemetry if invoked without clear user consent.

Description-Behavior Mismatch

Medium

• Confidence: 78% confidence
• Finding: The script performs broader persistent state management than its stated purpose of calling an image-search API: it creates session directories, index files, metadata manifests, and caches across multiple fallback locations. In an agent environment, this increases data retention and cross-task traceability, which can expose sensitive request/response content or session identifiers beyond the minimum necessary for the skill's function.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The top-level documentation explicitly says writing to /tmp is forbidden and that failure to write the current directory should raise an error, but the implementation silently falls back to home and temporary directories. This mismatch is dangerous because operators may rely on the documented storage guarantees when handling sensitive API responses, yet the code can persist them in less controlled locations including shared temp space.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The file is an image-upload utility inside a skill whose metadata describes Amazon competitor analysis, creating a capability-to-description mismatch. Such hidden or weakly justified functionality increases the chance of unauthorized data transfer and makes review and user consent less reliable.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script uploads a local file and explicitly sets x-oss-object-acl to public-read, then returns a publicly accessible URL. Publishing local user content to a public endpoint is sensitive behavior and is not justified by the declared competitor-analysis purpose, creating real risk of unintended data disclosure.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module documentation promises that writing to /tmp is forbidden and that failure to write in the current directory should raise an error, but the implementation silently falls back to home and temporary directories. That mismatch can cause sensitive Amazon/API response data to be persisted in less controlled locations than operators expect, increasing data leakage and compliance risk.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script implements a generic local-file uploader to a remote OSS service, which is materially unrelated to the declared Amazon competitor-analysis/report-generation purpose. That capability expansion is dangerous because it can be used to exfiltrate arbitrary local files under the guise of a benign analytical skill, especially when combined with automated agent execution and temporary cloud upload credentials.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.