亚马逊单竞品分析专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.1

Overview

The skill fits its Amazon competitor-analysis purpose, but it bundles credentialed network calls, public file upload, and active HTML report generation with weak scoping that users should review before installing.

Install only if you trust LinkFox and can run it in a controlled environment. Use a least-privilege API key, avoid setting gateway URL environment variables to non-LinkFox hosts, prefer a proper secret store over shell-profile exports, do not allow untrusted prompts to choose upload paths, and treat generated HTML reports as active content before opening or sharing them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:74

Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Endpoints

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:82

Finding

Unvalidated Session Identifiers Permit Filesystem Path Traversal

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-report-generator/scripts/inject_report.py:157

Finding

Report Generator Allows Active HTML and JavaScript Injection

Content

View full analysis

str: echarts_code = "" m = _ECHARTS_BLOCK_RE.search(content) if m: echarts_code = m.group(1).strip() echarts_code = _SCRIPT_OPEN_RE.sub("", echarts_code) content = _ECHARTS_BLOCK_RE.sub("", content).strip() canvas_code = "" m = _CANVAS_BLOCK_RE.search(content) if m: canvas_code = m.group(1).strip() canvas_code = _SCRIPT_OPEN_RE.sub("", canvas_code) content = _CANVAS_BLOCK_RE.sub("", content).strip() html = template.replace( "{{TITLE}}", title or "LinkFox Analysis Report", ) html = html.replace("{{LANG}}", language) html = re.sub( r".*?", "\n" + content + "\n", html, flags=re.DOTALL, ) if echarts_code: html = html.replace( "// ECHARTS_INIT_START\n // ECHARTS_INIT_END", "// ECHARTS_INIT_START\n " + echarts_code + "\n // ECHARTS_INIT_END", ) if canvas_code: html = html.replace( "// CANVAS_INIT_START\n // CANVAS_INIT_END", "// CANVAS_INIT_START\n " + canvas_code + "\n // CANVAS_INIT_END", ) ``` ### Technical Analysis The script performs mechanical string insertion rather than contextual output encoding or HTML sanitization. Removing literal `` tags from the designated chart blocks does not make the enclosed code safe. The remaining text is deliberately inserted into JavaScript execution regions in the template. The main repo ...[truncated 1991 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skills/linkfox-file-upload/scripts/file_upload.py:31

Finding

File Upload Skill Can Publish Arbitrary Readable Local Files

Content

View full analysis

[ ...]", file=sys.stderr, ) sys.exit(1) lp = _paths() results = [] voucher = None had_error = False for path in args: if not os.path.isfile(path): results.append({ "error": True, "input": path, "message": "File does not exist", }) had_error = True continue try: if voucher is None: voucher = lp.get_sts_voucher() res = lp.upload_file(path, voucher=voucher) res["localPath"] = os.path.abspath(path) results.append(res) except Exception as e: voucher = None results.append({ "error": True, "input": path, "message": str(e), }) had_error = True ``` Local file transmission: ```python file_size = os.path.getsize(local_path) max_size = voucher.get("maxFileSize") if isinstance(max_size, int) and max_size > 0 and file_size > max_size: raise RuntimeError("File exceeds the OSS size limit") supported = voucher.get("supportedTypes") if isinstance(supported, str) and supported.strip(): allowed = { t.strip().lower() for t in supported.split(",") if t.strip() } if allowed and ext not in allowed: raise RuntimeError("File type is not allowed") with open(local_path, "rb") as f: bucket.put_object(object_key, f, headers=headers or None) url = f"https://{bu ...[truncated 1949 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: skills/linkfox-file-upload/SKILL.md:32

Finding

Documentation Recommends Unpinned Runtime Dependency Installation

Content

View full analysis

None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The project instructs users to install mutable package names at runtime without: - Exact version pins. - Cryptographic hashes. - A lockfile. - A trusted index declaration. - An isolated environment requirement. The package names shown are established packages rather than observed typosquats, so no malicious package is directly embedded in the project. Nevertheless, unpinned installation makes the executed dependency set dependent on the active package index, configured mirrors, dependency resolution at installation time, and future package releases. Because imported Python modules execute code on import, compromise of the selected package or one of its transitive dependencies can become local code execution under the user's account. ### Attack Path 1. A user encounters a missing dependency while running the Skill. 2. The Skill instructs the user to execute an unpinned `pip install` command. 3. Pip resolves packages from the user's configured index or mirror. 4. A compromised package release, malicious mirror, or compromised transitive dependency is installed. 5. Malicious code executes during installation or when the Skill imports the package. ### Impact Assessment A compromised dependency executes with the same privileges as the Python process and may access: - Project files. - LinkFo ...[truncated 293 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-aigc-textgen/references/onboarding.md:11

Finding

Onboarding Instructions Persist API Keys in Plaintext Shell Profiles

Content

View full analysis

" # macOS zsh echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc source ~/.zshrc # Linux bash echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc source ~/.bashrc ``` ### Technical Analysis The onboarding workflow directs users to store an API credential in persistent shell startup configuration. Shell profiles are not purpose-built secret stores and commonly have a broad exposure surface: - Dotfile repositories and synchronization tools. - Home-directory backups. - Diagnostic or support bundles. - Processes launched from the shell that inherit the full environment. - Shell configuration inspection by unrelated local tooling. - Accidental disclosure in screenshots or configuration reviews. Using `setx` similarly persists the credential in the user's environment rather than a scoped secret manager. The instruction does not demonstrate file-permission hardening, token expiration, least-privilege scoping, secret rotation, or revocation guidance. ### Attack Path 1. The user follows the onboarding instructions and appends the key to a shell profile or persistent user environment. 2. The profile is backed up, synchronized, committed to a dotfile repository, read by another local process, or included in a support archive. 3. An attacker obtains the plaintext credential. 4. The attacker uses the key agains ...[truncated 454 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (209)

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS-login tokens, API keys, and user identifiers, to those endpoints via requests.post. If an attacker can influence environment variables in the skill runtime, they can redirect these calls to attacker-controlled infrastructure and exfiltrate credentials or session tokens.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway helper constructs outbound urllib requests using a base URL sourced from environment variables and attaches the API key in the Authorization header. A compromised or manipulated runtime environment could redirect billing, account, or package-management traffic to an attacker endpoint, exposing secrets and enabling fraudulent account actions.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

download_media() accepts an arbitrary caller-supplied URL and fetches it with urlopen, only checking for the http/https scheme. This creates an SSRF-style primitive that can be abused to make the agent reach internal services, cloud metadata endpoints, or other unintended network locations, then persist the response locally. In a shared utility used by multiple skills, the risk is amplified because unrelated workflows may inherit this network access path.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script derives base URLs from environment variables and sends sensitive authentication material, including SMS login data and bearer tokens, to those endpoints via requests.post. If an attacker can influence the runtime environment, they can redirect these calls to attacker-controlled infrastructure and exfiltrate credentials, API keys, or payment/session data. The skill context increases risk because this file handles account onboarding, token minting, and login flows rather than mere public ASIN analysis.

Content

Scanner excerpt · skills/linkfox-keepa-product-request/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is also sourced from environment variables and used to build urllib requests that include the LinkFox API key in the Authorization header. A malicious environment configuration can therefore redirect authenticated requests to an attacker endpoint and leak the API key, account metadata, order identifiers, and related billing information. This is especially dangerous because the script supports plan purchase and order creation, so redirected requests affect both secrets and payment workflows.

Content

Scanner excerpt · skills/linkfox-keepa-product-request/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-keepa-product-request/scripts/keepa_product_detail.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-keepa-product-series/scripts/keepa_product_history.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds destination URLs from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends login credentials, SMS codes, access tokens, refresh tokens, and API-key related requests to those endpoints via requests.post. If an attacker can influence the runtime environment, they can redirect sensitive authentication traffic to an attacker-controlled server, causing credential/token exfiltration and account compromise.

Content

Scanner excerpt · skills/linkfox-keepa-product-series/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. An attacker who controls the environment can redirect these requests to an arbitrary host and capture the API key and account/order data, enabling unauthorized API use and possible billing abuse.

Content

Scanner excerpt · skills/linkfox-keepa-product-series/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

download_media fetches arbitrary attacker-controlled http/https URLs and writes the response into the session workspace. That creates an SSRF primitive against internal services or cloud metadata endpoints, and can also be abused to make the agent download untrusted large content into local storage.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The script builds destination URLs from environment variables and then sends sensitive authentication material to those endpoints via requests.post. In this file, those requests carry SMS-login data, access tokens, refresh tokens, and headers used for token issuance, so a malicious or misconfigured environment can redirect secrets to an attacker-controlled host.

Content

Scanner excerpt · skills/linkfox-sif-asin-keywords/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The gateway URL is also derived from environment variables and used in urlopen with the Authorization header populated from the user's API key. This creates an exfiltration path where anyone controlling the runtime environment can force the tool to send API credentials and account/order requests to an attacker-controlled server.

Content

Scanner excerpt · skills/linkfox-sif-asin-keywords/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The script lets environment-controlled values influence the outbound request destination and transmitted metadata. LINKFOX_TOOL_GATEWAY can redirect requests to an attacker-controlled host, while SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME are sent as headers, enabling credential and task-metadata exfiltration if the environment is tampered with. In an agent skill context, environment variables are a trust boundary and should not be treated as inherently safe for network sinks.

Content

Scanner excerpt · skills/linkfox-sif-asin-keywords/scripts/sif_asin_keywords.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The POST target is derived from environment-controlled base URLs, and the function sends highly sensitive data including SMS login credentials, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication traffic to an attacker-controlled server and exfiltrate credentials or session material.

Content

Scanner excerpt · skills/linkfox-sif-asin-summary/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The gateway request URL is also built from environment-controlled base URLs and automatically includes the API key in the Authorization header. An attacker who can set the environment can redirect requests to a hostile endpoint and capture the user's API key, order details, and account metadata.

Content

Scanner excerpt · skills/linkfox-sif-asin-summary/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The request sends multiple environment-derived values, including an API key and session/message metadata, to a network endpoint whose base URL can also be overridden by the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable, the script can be redirected to an attacker-controlled server and leak credentials and potentially sensitive request data. In an agent/automation context, trusting environment-configured destinations without validation materially increases SSRF-style redirection and secret exfiltration risk.

Content

Scanner excerpt · skills/linkfox-sif-asin-summary/scripts/sif_asin_summary.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, API keys, and payment/order data to those endpoints. If an attacker can influence the environment, they can redirect traffic to attacker-controlled hosts and exfiltrate credentials or session material; because this file is explicitly an onboarding/login flow, the skill context makes the sink far more sensitive than an ordinary HTTP client.

Content

Scanner excerpt · skills/linkfox-sorftime-amazon-product-detail/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway client uses environment-derived base URLs and transmits the LinkFox API key in the Authorization header via urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect billing, account, and order operations to an attacker-controlled endpoint and capture API credentials or manipulate responses; this is especially dangerous because the same file also supports ordering and payment-related actions.

Content

Scanner excerpt · skills/linkfox-sorftime-amazon-product-detail/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The script builds a network request using environment-controlled values, including the base URL via LINKFOX_TOOL_GATEWAY and multiple metadata headers, then sends the request with urlopen. If an attacker can influence the environment, they can redirect requests to an arbitrary host and exfiltrate the API key, request parameters, and session metadata; in this agent-skill context, environment variables are a meaningful trust boundary and should not be treated as inherently safe.

Content

Scanner excerpt · skills/linkfox-sorftime-amazon-product-detail/scripts/sorftime_product_detail.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The skill appears to behave more like a single-interface data fetch/cache tool than the claimed four-step, multi-source deep-analysis system. This is a genuine trust and governance issue because security review, user expectations, and permissioning depend on accurate capability disclosure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to behave more like a single-interface data fetch/cache tool than the claimed four-step, multi-source deep-analysis system. This is a genuine trust and governance issue because security review, user expectations, and permissioning depend on accurate capability disclosure.

Content

No source excerpt is available for this finding.