亚马逊单竞品分析专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

The skill does the advertised Amazon competitor analysis, but it also includes account login, billing, public upload, and telemetry behaviors that need manual review before installation.

Install only in a trusted environment. Lock or verify LINKFOX_* endpoint variables before use, do not provide phone numbers or SMS codes unless you intend to create or access a LinkFox account, review any plan/order action before payment, and avoid public uploads or automatic feedback submission for private data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (63)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST destination is derived from helper functions that read environment variables for base URLs, so a hostile runtime can redirect login and token-bearing requests to an attacker-controlled host. Those requests carry sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, creating a real credential exfiltration risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request target is also constructed from environment-controlled base URLs before being passed to urlopen. Because the request includes the API key in the Authorization header and can trigger account, package, and order operations, endpoint redirection could leak credentials and facilitate unauthorized billing-related actions.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token generation requests to those endpoints. In a hostile or misconfigured runtime, overriding these environment variables can redirect authentication traffic and secrets to attacker-controlled servers, creating a credential exfiltration/SSRF-style risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request uses a URL derived from environment variables and sends the LinkFox API key in the Authorization header to that destination. If an attacker can influence the environment, they can redirect requests to an arbitrary host and capture the API key and account metadata, which is especially dangerous because this file also performs billing and order operations.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request target and headers are influenced by environment variables, most notably LINKFOX_TOOL_GATEWAY and metadata headers such as SESSION_ID, then sent via urlopen. This creates an SSRF-style exfiltration path where a hostile runtime can redirect authenticated requests, including the API key in the Authorization header, to an attacker-controlled endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill orchestrates file reads/writes, networked calls, and script execution but does not declare permissions or capability boundaries. This creates a governance and least-privilege failure: reviewers and runtime policy engines cannot accurately assess or constrain what the skill can access, increasing the chance of unintended data access, external exfiltration, or unsafe side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is limited to Amazon competitor analysis, but the behavior reportedly includes unrelated high-risk operations such as SMS-based login, API key acquisition, package/order/payment flows, public file upload, and asynchronous external AIGC processing. This mismatch is dangerous because it can conceal credential handling, billing actions, and data exfiltration behind an innocuous analytics description, defeating user consent and reviewer expectations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file documents APIs for a different skill (`linkfox-aigc-textgen`) than the declared Amazon competitor-analysis skill, indicating cross-skill capability drift or packaging confusion. In practice, this can cause the agent to invoke unrelated text-generation and external network endpoints, expanding data exposure and bypassing user expectations about what the skill is supposed to do.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documented capabilities include asynchronous AI text generation and an external feedback submission endpoint, which are not justified by the stated purpose of single-ASIN Amazon competitor analysis. This unnecessary capability expansion increases attack surface and creates opportunities for unintended outbound data transfer, prompt leakage, or covert exfiltration under the guise of report generation or feedback.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements a generic asynchronous AI text-generation client, not the manifest-described single-ASIN Amazon competitor analysis pipeline. This capability mismatch is dangerous because it gives the skill a broad prompt-driven exfiltration/processing surface that reviewers and callers may not expect, weakening least privilege and making abuse easier under a misleading label.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The referenced capability is a generic file-upload mechanism, while the declared skill purpose is single-ASIN Amazon competitor analysis. That mismatch expands the skill’s effective privilege surface and can enable unnecessary data exfiltration or public hosting of arbitrary artifacts unrelated to the stated business function, especially since uploaded URLs are described as publicly accessible.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The markdown describes a reusable arbitrary file upload primitive guarded only by extension and size checks from server-provided policy, without tying uploads to a narrow analysis use case. In the context of a skill that should analyze a single ASIN, this creates an unjustified avenue for uploading and externally exposing arbitrary files, which could be abused for data leakage, unauthorized content hosting, or movement of sensitive generated outputs.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The file implements a generic local-file uploader to publicly accessible OSS URLs, but the stated skill is for Amazon single-competitor analysis. This capability mismatch is dangerous because it introduces an unrelated data egress path that could upload arbitrary local files from the agent environment, including reports, credentials-adjacent artifacts, or other sensitive workspace content, under the cover of an unrelated skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script uploads user-specified local files to OSS and returns public HTTPS URLs, creating a direct exfiltration channel from the local environment to an external service. In the context of an Amazon analysis skill, this is unjustified and more dangerous because the capability is unrelated to the advertised purpose, making it easier to hide unauthorized collection or publication of local data.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to auto-report user feedback via a Feedback API for praise, dissatisfaction, mismatched intent, or anything improvable, which is unrelated to the core product-detail retrieval function. This can cause unprompted transmission of user interaction content to an external endpoint, creating privacy, consent, and data-governance risk even if the feature is meant for quality improvement.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation silently falls back to ~/linkfox and then $TMPDIR/linkfox. This can cause sensitive API responses to be written to unintended locations, including shared or less-protected temporary storage, undermining operator expectations and potentially exposing collected product data or API error payloads.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to download and install another skill package from a remote URL when onboarding guidance is missing. That expands trust boundaries far beyond the stated purpose of querying Keepa product history, creating a software supply-chain risk and enabling execution of unreviewed functionality under error conditions such as auth or quota failures.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The skill adds automatic feedback reporting behavior unrelated to its declared function of Amazon time-series analysis. Silent transmission of user interaction details or task metadata to a feedback API creates an undisclosed data-sharing path and can exfiltrate behavioral or contextual information without meaningful user awareness or consent.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring promises output will remain under the current working directory and explicitly forbids /tmp, but the implementation can fall back to ~/linkfox and the system temp directory. This mismatch can cause users or calling agents to make unsafe assumptions about where potentially sensitive API responses are persisted, increasing the risk of unintended disclosure on shared systems.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically report user feedback via a separate Feedback API whenever the user expresses praise, dissatisfaction, or when the model believes something could be improved. This is unrelated to the core ASIN keyword lookup function and can cause undisclosed transmission of user content or inferred sentiment to another endpoint, creating privacy, consent, and data-governance risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The document includes a separate public feedback API that is unrelated to the ASIN keyword retrieval endpoint, creating an unnecessary secondary capability in the skill reference. In an agent context, this can cause the agent to transmit user content or operational details to an external service not required for the requested task, increasing the risk of unintended data exfiltration or misuse of user interactions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This onboarding document materially expands the skill's behavior from ASIN competitor analysis into account recovery, registration, API key provisioning, and billing/payment handling. That scope expansion increases the attack surface and creates opportunities for misuse or social engineering because operators may be led to collect credentials, guide purchases, and handle account lifecycle actions unrelated to the stated analytical purpose.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions direct the operator to collect and use a user's phone number, send a verification code, and complete login through a script. Collecting phone numbers and authentication factors is sensitive account-access behavior that is not justified by a single-ASIN analysis skill and could enable account takeover, privacy violations, or unauthorized registration if mishandled.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This onboarding script performs SMS login, token acquisition, account inspection, package discovery, and order management, which are outside the advertised single-ASIN analytics function. Such capability expansion increases the blast radius of the skill by enabling collection of user credentials and account-level actions not necessary for report generation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code can create paid orders and render payment QR codes despite the skill being presented as an analytics/reporting tool. Embedding purchase flows in a data-analysis skill is risky because it can surprise users, enable unintended charges, and normalize financial actions under a broader trust boundary than necessary.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.