蓝海扫描专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:07 AM UTC
• Version: 1.0.2

Overview

The skill is a real LinkFox market-analysis bundle, but it also handles credentials, billing, scheduled tasks, public uploads, automatic feedback, and persistent local data storage that users should review before installing.

Install only if you are comfortable giving this package a LinkFox API key and letting it call LinkFox services, write full raw results under a local linkfox directory, and potentially create scheduled tasks or public upload URLs when asked. Avoid setting LINKFOX_TOOL_GATEWAY or onboarding API override variables to untrusted hosts, prefer self-service account setup where possible, and do not share phone/SMS codes or payment steps unless you intentionally want the LinkFox onboarding/billing flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (230)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data to them via requests.post. Because this same file handles phone numbers, SMS codes, bearer tokens, and API-token generation, a hostile or misconfigured environment can redirect authentication traffic to an attacker-controlled endpoint and exfiltrate credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway URL is also derived from environment variables and used in urllib.request.urlopen with the API key attached in the Authorization header. If an attacker can influence the environment, they can redirect paid-order, account, and package requests to a malicious server and capture the API key and related account metadata.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request sent via urlopen includes environment-derived values in both the destination selection path and HTTP headers, most notably LINKFOX_TOOL_GATEWAY as the base URL and SESSION_ID/MODE_ID/APP_NAME as outbound metadata. If an attacker can influence the environment, they can redirect requests to an arbitrary server and exfiltrate the API key and request data, making this a real SSRF/credential-leak risk rather than a harmless configuration pattern.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST destination is ultimately derived from environment-controlled base URLs, so a hostile runtime can redirect SMS login, token exchange, and API-key workflows to attacker infrastructure. Because these requests carry phone numbers, verification codes, access tokens, refresh tokens, and generated API keys, this becomes an SSRF/exfiltration channel rather than a harmless configuration pattern.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request target is also built from environment-controlled base URLs and then used by urlopen with the Authorization header populated from the agent API key. An attacker who can influence environment variables can cause authenticated requests to be sent to an attacker-controlled server, exposing credentials and enabling unauthorized API actions.

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 86% confidence
• Finding: The script builds outbound requests using environment-controlled configuration, including the base URL from LINKFOX_TOOL_GATEWAY and sensitive headers such as the API key. If an attacker can influence the environment, they can redirect requests to an attacker-controlled endpoint and exfiltrate credentials and request data, which is especially risky because this is a generic text-generation client likely to handle arbitrary user content.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive material such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token management requests to those endpoints. If an attacker can influence environment variables, they can redirect authentication and token traffic to attacker-controlled servers, enabling credential theft and account takeover.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 97% confidence
• Finding: Gateway requests are sent to a URL derived from environment variables while automatically attaching the LINKFOX API key in the Authorization header. An attacker who can set the gateway base URL can exfiltrate the API key and influence order, package, and account queries by redirecting traffic to a malicious endpoint.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 97% confidence
• Finding: The request sent via urlopen includes attacker-influenced destination or headers derived from environment variables, notably LINKFOX_TOOL_GATEWAY and session-related metadata headers. In an agent/runtime context, environment variables are part of the trust boundary; if an attacker can influence them, the script can exfiltrate the API key and request payload to an arbitrary endpoint or unauthorized service.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables, they can redirect authentication traffic to an attacker-controlled host and exfiltrate credentials or payment-related data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: Gateway requests are sent to a URL assembled from environment-controlled base values while attaching the API key in the Authorization header. An attacker who controls the environment can redirect these requests to a malicious server and capture API credentials, user info, order operations, and other account data.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 94% confidence
• Finding: `download_media()` performs outbound requests to an arbitrary caller-supplied URL using `urlopen` with no host allowlist, no DNS/IP validation, and only a scheme check for http/https. This is a classic SSRF primitive that can be used to reach internal services, cloud metadata endpoints, or other restricted network locations, and it also writes the fetched content into the shared session workspace.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST target is built from environment-controlled base URLs and then receives sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token operations. If an attacker can influence LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, the script will transmit credentials to an attacker-controlled endpoint, enabling credential theft and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request URL is also derived from environment variables and is called with the Authorization header populated from LINKFOX_AGENT_API_KEY. An attacker who controls LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY can redirect authenticated requests to an external server and capture the API key and downstream account/order data.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request sent via urlopen includes environment-derived values in headers, including the API key and session metadata, and the destination host is also configurable via the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable, the script will transmit credentials and contextual identifiers to an arbitrary server, creating a real credential exfiltration path. In an agent/skill environment where env vars are commonly injected by the runtime, this is more dangerous than a normal desktop script.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST destination is derived from environment-controlled base URLs and the function sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. In an agent/runtime setting where environment variables may be influenced by deployment or another tool, this enables credential exfiltration or SSRF-like redirection to attacker-controlled services.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request uses a URL built from environment-controlled base configuration and attaches the API key in the Authorization header before calling urlopen. If the base URL is redirected to an untrusted host, the skill will transmit the API key and perform authenticated requests against an attacker-selected endpoint.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-configurable base URLs and then used for authenticated requests. In this script, those requests can carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, so a malicious or compromised environment can redirect secrets to an attacker-controlled endpoint. The skill context increases risk because this file is not core market-scanning logic; it is an onboarding/payment helper that handles especially sensitive credentials and account actions.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request URL is built from environment-controlled base settings and used with the Authorization header containing the API key. If an attacker can influence environment variables, they can redirect authenticated traffic and harvest API keys or manipulate billing/order actions against a rogue service. This is especially dangerous here because the script supports account info retrieval, package lookup, order creation, and order status queries.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 87% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used to transmit login data, SMS verification requests, access tokens, and other sensitive account information. If an attacker can influence these environment variables, the script can be redirected to an attacker-controlled endpoint, causing credential and token exfiltration; this is especially dangerous because the script handles authentication and API-key issuance flows.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 85% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and used with the Authorization header containing the API key. An attacker who can modify the environment can redirect these authenticated requests to an arbitrary server and capture the bearer credential, enabling account misuse, purchases, or data access.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST target URL is derived from environment-configurable base URLs and then used to transmit authentication material, phone numbers, SMS codes, access tokens, and generated API keys. In a hostile or misconfigured runtime, these environment variables can redirect requests to attacker-controlled endpoints, enabling credential interception and account takeover.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request uses an environment-derived base URL and attaches the API key in the Authorization header before calling urlopen. If an attacker can influence the environment, the script will exfiltrate the API key and order/account operations to an arbitrary server.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The HTTP POST target is derived from environment-controlled base URLs, and the function transmits sensitive data including SMS login details, access tokens, refresh tokens, and generated API tokens to that destination. In an agent/runtime environment, environment variables can be influenced by deployment configuration or a malicious wrapper, so this creates an SSRF/exfiltration path for credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request uses a URL built from environment-controlled base configuration and sends the agent API key in the Authorization header. If an attacker can alter the environment, they can redirect authenticated requests to an attacker-controlled server and capture the API key or induce unintended outbound requests.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57