Back to skill

Security audit

ASIN-Keepa曲线解读专家

Security checks across malware telemetry and agentic risk

Overview

The skill does ASIN analysis, but it also bundles account login, API-key creation, payment, public upload, telemetry, and generic crawling capabilities that need careful review.

Install only if you trust LinkFox with the ASINs, generated reports, API key, phone/SMS onboarding flow, and any files you choose to upload. Treat uploads as public, review any payment or credit-purchase prompt before acting, and avoid setting gateway environment variables to untrusted hosts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (117)

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
96% confidence
Finding
with urlopen(req, timeout=HTTP_TIMEOUT) as response:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
89% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
88% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
94% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
92% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
91% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
87% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill directs the agent to read/write local files, run Python, and call multiple networked tools, but it declares no permissions or user-visible capability boundaries. That creates a trust and governance gap: operators and users cannot accurately assess what the skill may access or modify, increasing the chance of unintended data exposure or unsafe execution in a broader agent environment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose is narrow ASIN/Keepa competitor analysis, but the underlying behavior reportedly includes unrelated high-risk capabilities such as authentication flows, API key issuance, payment/order operations, public file upload, generic web crawling, and HTML templating/injection. This mismatch is dangerous because it hides a much larger attack surface than the user expects, enabling sensitive actions, exfiltration, or abuse through a skill that appears harmless and domain-specific.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is documented as a text-generation tool, but these sections instruct the agent to automatically chain into downstream image/video generation skills and pass generated content onward. That expands the skill’s effective authority and data flow beyond its stated scope, increasing the chance of unintended tool invocation, privilege creep, and user data being propagated to additional external services without clear user intent.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The document first mandates automatic chaining into image/video generation paths, then later states those capabilities are out of scope. This contradiction is dangerous because agents may follow the stronger procedural instructions rather than the scope statement, leading to unexpected cross-skill execution and weakening operator understanding of what the skill is actually allowed to do.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The referenced API document is for a different skill (`linkfox-aigc-textgen`) than the declared ASIN/Keepa analysis skill, which indicates capability drift or packaging confusion. In practice this can cause the skill to invoke unrelated remote text-generation functionality, expanding data exposure and permissions beyond what a user would reasonably expect from a Keepa analysis tool.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The API provides generic remote text-generation from arbitrary prompts and media URLs, which is broader than the stated purpose of Keepa/ASIN curve analysis. That mismatch increases the chance that the skill can be repurposed to transmit user-supplied content to an external model service or generate outputs outside the expected analysis boundary, undermining least privilege and informed consent.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The file embeds operational guidance for authentication, registration, and billing flows that are unrelated to the advertised ASIN/Keepa competitor-analysis purpose of the skill. This expands the skill’s authority into account provisioning and payment handling, creating a confused-deputy risk where an analysis skill can steer users into executing local scripts for credential and purchase workflows.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The file implements a generic AIGC text-generation client, while the declared skill is for Keepa/ASIN competitor and lifecycle analysis. This capability mismatch is dangerous because users and orchestrators may grant trust, data access, or execution based on the stated commerce-analysis purpose while the code actually transmits arbitrary prompts/content to a remote text-generation service.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This file implements account onboarding, SMS authentication, API key issuance, subscription listing, order creation, and payment QR rendering, which are unrelated to the stated ASIN/Keepa analytics purpose. Such hidden or mismatched capabilities materially increase risk because the skill can collect credentials, provision access, and initiate commercial actions under the guise of analytics functionality.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The ordering and payment QR generation functions enable subscription purchase flows that are not justified by the declared analytics role. In context, this creates a capability for unauthorized or deceptive monetization, especially because the code can guide users directly into payment actions from within a mismatched skill.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code sends SMS verification codes, logs users in, exchanges tokens, fetches team information, and obtains or generates API keys. For an ASIN/Keepa analysis skill, this is unjustified credential collection and account access enablement, making the skill substantially more dangerous because it can harvest identities and issue reusable secrets.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
This file documents a generic file-upload capability, including credential acquisition and publication of uploaded files, which is unrelated to the declared ASIN/Keepa analysis purpose. That mismatch expands the skill's effective capabilities and increases the risk of covert data exfiltration or unauthorized file handling under the guise of an analytics tool.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The documented API supports uploading arbitrary local files and returning a publicly accessible HTTPS URL, which is dangerous in a skill whose stated purpose is analytics rather than file transfer. In context, this creates a plausible exfiltration path for sensitive local data, with the public URL making accidental or unauthorized disclosure more severe.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file implements a generic local-file upload utility to Alibaba OSS and returns public HTTPS URLs, which is materially unrelated to the declared ASIN/Keepa competitive-analysis purpose. Capability mismatch is dangerous because it can hide data-exfiltration or unauthorized publishing functionality inside a skill that users and reviewers would reasonably expect to perform analytics only.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
skills/linkfox-plugin-web-data-crawler/scripts/run_crawl.py:110