服装品类关键词挖掘专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:32 AM UTC
• Version: 1.0.0

Overview

The apparel keyword workflow is mostly coherent, but the package also includes broad AI, public file-upload, external API, and automatic storage behavior that users should review before installing.

Install only if you are comfortable sending product images or media URLs, product context, mined keywords, and keyword-library data to LinkFox-configured services, and if you trust the configured LINKFOX_TOOL_GATEWAY. Treat generated Excel/JSON/report files and any uploaded OSS URLs as potentially sensitive; avoid using the bundled upload skill for private files unless you explicitly want a public link.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tainted flow: 'req' from os.environ.get (line 422, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url = _GATEWAY + path
        data = json.dumps(body, ensure_ascii=False).encode("utf-8")
        req = _Request(url, data=data, headers=headers, method="POST")
        with _urlopen(req, timeout=120) as resp:
            return json.loads(resp.read().decode("utf-8"))

    # 1. Create task

• Confidence: 95% confidence
• Finding: The LLM backend builds its destination from LINKFOX_TOOL_GATEWAY and then sends prompts plus Authorization credentials from environment variables to that endpoint. If an attacker can influence the environment, they can redirect requests and exfiltrate API keys, product context, and mined keywords to an arbitrary server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and instructs use of shell execution, network access, and file read/write while declaring no permissions, which creates a transparency and policy-enforcement gap. Even if the actions are central to the workflow, missing permission declarations can let a reviewer or runtime underestimate the skill's effective capabilities and increase the risk of unintended data access or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a narrow apparel keyword-mining workflow, but the behavior reportedly includes broader AIGC generation, external library access, OSS upload, report/template output, and SQLite persistence that are not clearly disclosed. This mismatch is dangerous because users and reviewers may provide data under a narrower trust assumption while the skill can transmit, persist, or transform that data in additional ways beyond the stated scope.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The referenced API documentation describes a generic AI text-generation service and a separate feedback endpoint that do not align with the stated purpose of an apparel keyword-mining skill. This mismatch can cause the agent to send product images, prompts, and generated keyword context to an unrelated text-generation backend, increasing the chance of unintended data disclosure, misuse of capabilities, or user deception about what the skill actually does.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation is a generic async AI text-generation client, which materially differs from the manifest's claimed apparel keyword mining and semantic tagging purpose. This mismatch is dangerous because it broadens capability beyond user expectations, making it easier to invoke unrestricted text generation in contexts where a narrowly scoped merchandising tool was expected and approved.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script embeds a generic media-downloading helper unrelated to the stated apparel keyword-mining purpose. Unnecessary downloader functionality increases attack surface and, if later wired to user input, can become an SSRF or untrusted-content ingestion primitive inside an otherwise text-focused skill.

Description-Behavior Mismatch

Medium

• Confidence: 77% confidence
• Finding: This shared utility persists session metadata, writes arbitrary data/report/media files, uploads local files to OSS, and downloads remote media, which is broader than the apparel keyword-mining skill description suggests. In an agent setting, this expanded I/O surface increases the chance of unintended data retention, cross-skill data exposure, or misuse to move files off-host without clear user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: `download_media` can fetch arbitrary remote URLs and store the results locally under the session directory, which is a broader capability than keyword mining alone requires. In an agent environment, such generic fetch functionality can be abused for SSRF-like access to attacker-chosen resources, unexpected large downloads, or importing untrusted content into later processing steps.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file performs external LLM-based semantic tagging and library splitting, which materially expands behavior beyond simple suggestion mining. That scope expansion increases data exposure and trust surface because user/product content is transmitted to another service and classification logic can affect downstream listing/PPC decisions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script automatically writes JSON/XLSX outputs to session or local filesystem paths even when the user did not request persistence. This can leak commercially sensitive keywords, product context, and LLM classifications into shared storage or leave residual data behind unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The miner reads API credentials from environment variables and uses them to call an unrelated text-generation gateway, creating an additional external trust boundary not implied by suggestion mining alone. In a shared agent environment, this increases risk of secret misuse and silent transmission of user-supplied context to a third-party service.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script is a generic uploader to Alibaba Cloud OSS and exposes public HTTPS URLs for arbitrary local files, which is materially unrelated to the declared apparel keyword-mining purpose. This kind of capability mismatch is dangerous because it can be used to exfiltrate local data under the guise of a benign analytics skill, and the skill context makes it more suspicious rather than less since users would not expect file-upload behavior here.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module docstring openly describes a file-upload tool, directly contradicting the manifest's keyword-mining description. This inconsistency is a security problem because it conceals the actual capability from reviewers and users, increasing the risk that sensitive files are uploaded without informed consent; in this context, the mismatch heightens suspicion of deceptive packaging.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The module documentation says the script performs keyword-library queries, but the implementation also persists the full API response to local storage. That can silently store sensitive business data or identifiers returned by the backend, increasing exposure through local file access, unintended retention, or later collection by other tools/users on the same system. In the context of a keyword-management skill, storing full server responses is more dangerous because returned word libraries may contain proprietary marketing terms, negative keyword lists, or account-scoped metadata.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The workflow requires writing product_context to a temporary file in /tmp without addressing retention, access control, or cleanup. Even if the data is not highly sensitive in most cases, product metadata, inferred attributes, and user-supplied details can be exposed to other processes, session artifacts, or later users if temp storage is not handled safely.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The skill automatically saves a structured 7-sheet Excel file containing mined keywords and inferred product attributes without warning about local persistence. Automatic disk output can expose commercially sensitive marketing data, inferred product details, or user inputs through shared storage, backups, or accidental redistribution.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match common user requests such as general writing help, image recognition, and video analysis, which can cause this skill to activate unexpectedly. Because the skill forwards prompts and media URLs to external AI services, overbroad invocation increases the risk of unintended data disclosure and wrong-tool execution, especially in multi-skill environments.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill accepts user text plus image and video URLs and sends them to external AI/API services, but it does not clearly warn users of that data transfer. This creates a meaningful privacy and confidentiality risk because users may provide proprietary, personal, or sensitive media without understanding that it will leave the local agent context and be processed by third parties.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The feedback API sends user-provided content to a separate external service, but the document does not warn that this transmission occurs or require consent/sanitization. In this skill context, feedback may contain merchant data, product details, prompts, outputs, or operational notes, so silent forwarding creates a real privacy and data-governance risk.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The script automatically writes full model responses to disk when they exceed a size threshold, without an explicit opt-in at the write point. This can persist sensitive prompts, generated content, or embedded business data locally, creating unintended data-retention and disclosure risk in shared workspaces.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script transmits mined keywords, seed terms, and product context to an LLM service with no explicit notice, consent, or sensitivity check in this file. In a keyword-mining workflow, product context may include proprietary listing strategy, unreleased product details, or marketplace research data, so silent external disclosure creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code combines system and user prompts and sends product context to an external LLM service without an in-context privacy warning or explicit consent at the moment of transmission. If product context contains confidential launch, brand, or merchandising data, that information is exposed outside the mining workflow.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script reads arbitrary product context from a local file and later forwards that content to LLM backends, again without explicit privacy disclosure. This is especially risky because file-based input often contains richer internal notes or strategy documents than a short command-line argument.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger text is extremely broad and instructs activation whenever a user needs a URL for a local file, even if they did not explicitly ask to upload. In this skill, activation causes public publication to OSS, so overbroad matching can lead to unintended exposure of local artifacts, reports, images, or other sensitive files through publicly accessible URLs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that uploaded files are turned into publicly accessible HTTPS URLs and recorded in session metadata, but it provides no warning about data exposure, retention, or metadata side effects. If users upload sensitive product images or documents, this can cause unintended disclosure through public object access and persistent deliverable tracking.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: skills/linkfox-apparel-keyword-expert/CLAUDE.md:7