新手推荐选品专家-卖家精灵

• Outcome: Review
• Latest audit: Aug 9, 2026 · 4:59 AM UTC
• Version: 1.0.1

Overview

The skill is mainly a product-scouting assistant, but it bundles broader account, payment, upload, scheduling, and agent-modification capabilities that are not clearly scoped to that purpose.

Install only if you trust the LinkFox ecosystem and are comfortable with this package using an API key, creating paid-plan/order flows, storing product-search state locally, creating or deleting remote scheduled tasks, and potentially exposing local files through public upload if that subskill is invoked. Avoid running patch_scoring_to_agent.py --all or response_io.py with untrusted paths, and do not set LINKFOX_TOOL_GATEWAY or related base-url environment variables to untrusted hosts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 94% confidence
• Finding: The code launches a subprocess to execute another Python script, and the script path is not fixed: it is derived from the SELLERSPRITE_SCRIPT environment variable. Although subprocess.run is used without shell=True, this still permits execution of attacker-chosen code if the environment is influenced, which is dangerous in an agent context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), params_str],
            capture_output=True,
            text=True,

• Confidence: 92% confidence
• Finding: The helper executes a Python script path supplied via --script using subprocess.run(). Although it avoids shell injection by passing an argument list, it still enables arbitrary local Python code execution if an attacker can influence the script path or induce the agent to invoke this wrapper on unintended files. In a narrowly scoped beginner product-scout skill, a generic script runner materially expands the attack surface beyond the declared business purpose.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 91% confidence
• Finding: The subprocess working directory is taken from ACPX_WORKSPACES or the current directory, both of which are environment-influenced. This can change import resolution, relative file access, and execution behavior of the child process, enabling code execution or data access in an attacker-controlled workspace.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 81, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 98% confidence
• Finding: SKILL_SCRIPT is sourced from os.environ.get("SELLERSPRITE_SCRIPT") and then executed with Python. This is a direct arbitrary-code-execution primitive for anyone who can influence the environment, and the skill's benign product-scouting purpose does not justify such capability.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST destination is derived from environment-controlled base URLs and the function sends sensitive authentication material such as SMS login data, access tokens, refresh tokens, and API-token requests to that destination. If an attacker can influence environment variables in the runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or impersonate users.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and used with an Authorization header containing the API key. An attacker who can set the environment can redirect this traffic and capture the API key or manipulate package, order, and account API responses.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data to them via requests.post. Because the same flow carries SMS login credentials, access tokens, refresh tokens, and API-token operations, a malicious or poisoned environment can redirect these secrets to an attacker-controlled server with no allowlist or TLS pinning.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway URL is also derived from environment variables and used by urllib.request.urlopen while attaching the API key in the Authorization header. If an attacker can influence the process environment, they can exfiltrate the API key and induce authenticated requests to arbitrary infrastructure.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 89% confidence
• Finding: The request sent via urlopen includes multiple values sourced from environment variables, including the Authorization API key and routing metadata such as LINKFOX_TOOL_GATEWAY and SESSION_ID. Because the destination host is also environment-controlled, a compromised runtime can redirect the request and exfiltrate credentials or sensitive request data to an attacker-controlled endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions while its documented behavior invokes shell commands, reads/writes local files, uses networked skills/APIs, and persists state. This creates a trust-boundary problem: reviewers and runtime policy may treat it as low-risk even though it has broad operational capabilities, increasing the chance of unintended file modification, data exposure, or command misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is beginner product scouting, but the analysis indicates materially broader behavior including patching other agents' prompt files, onboarding/account flows, OSS upload, task scheduling, and HTML report generation. That mismatch is dangerous because users and defenders may authorize a seemingly narrow selection tool while it can alter other agent configs, move data externally, and perform unrelated privileged operations.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script's behavior exceeds the declared purpose of a beginner seller recommendation expert by modifying arbitrary agent CLAUDE.md files and injecting new skill calls and workflow steps. In a skills ecosystem, cross-agent prompt/document rewriting is dangerous because it can silently alter other agents' behavior, expand capabilities, and propagate instructions without the target agent owner's informed review.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The --all mode enumerates /root/.linkfox/workspaces/agents and bulk-rewrites every discovered CLAUDE.md, which enables mass modification of agent definitions with a single command. In the context of an end-user-facing product-selection skill, this workspace-wide discovery and rewriting is unjustified and increases blast radius dramatically if the script is run accidentally or abusively.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill defines SKILL_SCRIPT from an environment variable and falls back to a local path, meaning an external actor can redirect execution to an arbitrary Python file. For a product-scouting assistant, hidden code-loading flexibility is unjustified and materially increases the risk of malicious code execution.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file is a generic I/O wrapper that can launch any Python main script, not just the SellerSprite beginner product-scout workflow described in the skill metadata. That scope expansion means the skill can be repurposed as a general local code-execution primitive, which is dangerous in agent environments where tools may be composed or called with attacker-influenced arguments.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The --params-file path and read subcommand allow the skill to read arbitrary local files accessible to the process, then parse or expose their contents. Even if intended for large JSON payloads and persisted outputs, this capability is broader than necessary for a beginner scouting skill and can be abused to inspect local data if an attacker can steer file paths.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill declares image and video generation as 'not applicable' but elsewhere instructs automatic chaining into image/video generation skills. This inconsistency can cause unsafe or unintended cross-skill execution, especially if downstream media-generation tools have different permissions, side effects, or safety controls than plain text generation.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The documentation mandates automatic orchestration of other AIGC skills based on internal decision rules rather than explicit user confirmation. That creates a prompt-induced action escalation risk where a benign text request can trigger additional tool invocations, increasing attack surface, data flow between skills, and the chance of unintended external requests or costly operations.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The referenced API exposes a broad AI text-generation capability that is materially more general than the seller-focused skill description. This capability mismatch can enable scope creep, policy bypass, or unintended use of the skill as a generic content-generation proxy, especially if higher-level controls assume the skill is limited to beginner seller product-selection tasks.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The onboarding document instructs the agent to handle authentication recovery, scripted account registration via phone number, API key acquisition, and paid plan purchase flows that are unrelated to the stated seller-product-selection purpose. This unnecessary expansion of capability increases attack surface, enables collection of sensitive user data and credentials, and creates a path for the skill to steer users into external account and payment workflows outside its declared scope.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The file introduces billing support, plan selection, payment method handling, order creation, and payment status queries despite the skill being described as a product recommendation expert for new sellers. Bringing payment flows into an unrelated skill can facilitate phishing-like redirection, unauthorized purchases, or social engineering by normalizing financial actions that users do not expect from this context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements a generic asynchronous AI text-generation client, but the declared skill metadata describes a beginner seller product-selection expert. This capability mismatch is dangerous because it expands what the skill can do beyond its advertised purpose, reducing user transparency and making misuse or prompt-driven abuse harder to detect in an agent ecosystem.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements account onboarding, SMS authentication, API-key issuance, package listing, order creation, and payment QR rendering, which is materially different from the declared SellerSprite product-selection advisor purpose. This mismatch is dangerous because it can trick users or reviewers into approving a skill that actually provisions accounts and facilitates commerce on another platform.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The package and order workflow adds commerce capabilities unrelated to the stated beginner seller recommendation use case. Hidden purchasing functionality increases the risk of unauthorized charges, deceptive monetization, and collection of payment-related artifacts under a misleading skill identity.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs SMS login, token exchange, team discovery, and API token generation for LinkFox accounts, none of which matches the declared SellerSprite recommendation role. This creates a high-risk credential-handling surface hidden inside an unrelated skill context, making phishing-like abuse and unauthorized account access more plausible.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57