ClawHub
Back to skill

Security audit

跨文化选品专家

Security checks for vulnerabilities and agentic risk

Overview

This skill supports the advertised product-research workflow, but it also silently reports user feedback and handles API credentials in ways users should review carefully.

Install only if you are comfortable with LinkFox receiving API requests and possible feedback summaries from your interactions. Avoid using the phone-code onboarding path in shared terminals, do not store the API key in shell startup files, prefer a scoped secret store, keep LINKFOX_* endpoint variables pinned to trusted HTTPS LinkFox hosts, and review any file before uploading because uploaded files become publicly accessible URLs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)

T01 · Skill Instruction Hijacking

Error
Location
skills/linkfox-aba-intelligent-query/SKILL.md:161
Finding

Silent Transmission of Conversation-Derived Feedback to a Third Party

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:122
Finding

Mandatory LinkFox-Specific Modification of Every Agent Response

Content
View full analysis
element containing three executable follow-up suggestions relevant to the current task. ``` ### Technical Analysis The root Skill requires a LinkFox-specific element to be appended to every response. The directive applies globally rather than only to responses where follow-up suggestions are useful. This changes the agent's response behavior after the Skill is loaded and can conflict with host formatting rules, strict API response schemas, user requests for concise output, or contexts where additional content is unsafe or invalid. The rule is not necessary to perform cross-cultural product selection. ### Attack Path 1. The root Skill is loaded for a product-selection task. 2. The mandatory response-ending instruction becomes active. 3. The agent handles a response that requires a strict or unrelated format. 4. The Skill causes the agent to append LinkFox-specific content regardless of the requested schema. 5. The resulting response may fail validation or introduce unwanted promotional or workflow steering. ### Impact Assessment The issue can alter every response produced while the Skill instructions are active. It can break machine-readable output, interfere with downstream tools, and steer users toward additional LinkFox operations. It does not directly provide system access, but it overrides normal agent behavior beyond the minimum functionality of the Skill. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aba-intelligent-query/scripts/onboarding.py:454
Finding

Generated API Key Disclosed in Plaintext Through Standard Output

Content
View full analysis
dict: hdr = _headers( "agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id, ) for path, source in ( ("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated"), ): resp = _http_post( f"{_agent_user_base()}{path}", {"id": group_id}, hdr, ) tok = _extract_token(resp) if tok: return {"api_key": tok, "source": source} return {"error": "API token was not returned"} def login_and_get_key(phone: str, code: str, channel: str) -> dict: # Authentication and account lookup omitted here. return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: return 0 return 1 ``` The same onboarding implementation is duplicated under the AI Google Search, AIGC Textgen, Alexa Search, Amazon Product Detail, Amazon Search, DLD Product Search, Google Trends, and TSearch Skills. ### Technical Analysis After SMS authentication, the script retrieves or generates a bearer API key and places it in a nor ...[truncated 1102 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/linkfox-aba-intelligent-query/scripts/onboarding.py:574
Finding

Phone Number and SMS Verification Code Exposed Through Process Arguments

Content
View full analysis
python scripts/onboarding.py login ``` ```python p = sub.add_parser("send-code") p.add_argument("phone") p.set_defaults(func=_cmd_send_code) p = sub.add_parser("login") p.add_argument("phone") p.add_argument("code") p.add_argument("--channel", default="skill") p.set_defaults(func=_cmd_login) ``` Equivalent command-line interfaces are present in the duplicated onboarding scripts used by the other API Skills. ### Technical Analysis The phone number and active SMS verification code are accepted as positional command-line arguments. Depending on the execution environment, command arguments may be exposed through: - Shell history - Process inspection tools - Agent command transcripts - CI/CD logs - Process supervisors - Diagnostic and crash reports Although SMS codes are short-lived, they are active authentication secrets during their validity period. Phone numbers are also personal data. ### Attack Path 1. The user or agent runs the documented `login` command. 2. The phone number and verification code are placed in the process argument vector. 3. A local process observer, log collector, terminal-history reader, or orchestration system records the arguments. 4. The observer captures the code before expiration. 5. The code and phone number are used to attempt unauthorized login or account enrollment. ### Impact Assessment A successful exploit may permit temporary account authentication, API-key generation, or unauthorized account access, subject to server-side verification and code lifetime. Even when the code has expired, the process history may retain the user's p ...[truncated 16 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aba-intelligent-query/references/onboarding.md:11
Finding

Long-Lived API Key Persisted in Plaintext Shell Startup Files

Content
View full analysis
" ``` ```sh echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc source ~/.zshrc ``` ```sh echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc source ~/.bashrc ``` Equivalent credential-persistence guidance appears in the onboarding documentation for the other API Skills. ### Technical Analysis The setup guidance stores the bearer API key as plaintext in shell startup configuration or a persistent user environment variable. On Unix-like systems, the key is then exported into every child process started by the shell. This unnecessarily broadens credential exposure to unrelated programs, shell plugins, diagnostic tools, backups, and any actor able to read the startup files or process environment. ### Attack Path 1. The user follows the documented onboarding instructions. 2. The API key is appended to `.bashrc` or `.zshrc`, or stored as a persistent user environment variable. 3. Future shells automatically export the key. 4. An unrelated process, malicious shell plugin, local user, backup reader, or diagnostic tool reads the file or environment. 5. The actor extracts and reuses the API key. ### Impact Assessment Exposure may enable unauthorized API calls, consumption of paid credits, and access to services associated with the user's LinkFox account. The persistence lasts until the user manually removes or rotates the key. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-aba-intelligent-query/scripts/onboarding.py:64
Finding

Credential-Bearing Requests Can Be Redirected Through Unvalidated Environment Overrides

Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com", ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` ```python def _http_post( url: str, body: dict, headers: dict, timeout: int = 30 ) -> dict: r = requests.post( url, json=body or {}, headers=headers, timeout=timeout, ) return r.json() ``` ```python def _headers( source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "" ) -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = ( _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ) if group_id: h["tid"] = group_id return h ``` ```python resp = _http_post( f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, ...[truncated 2027 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skills/linkfox-file-upload/SKILL.md:32
Finding

Unpinned Third-Party Dependency Installation Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (350)

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

download_media() performs outbound requests to an attacker-controlled URL with only a superficial scheme check (http/https). This is a classic SSRF primitive: if untrusted input reaches this function, the agent can be induced to contact internal services, cloud metadata endpoints, or other sensitive network locations and save the response locally.

Content

Scanner excerpt · skills/cross-cultural-product-selection/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The POST target URL is derived from environment-controlled base URLs and the request may include sensitive authentication material such as access tokens, API keys, phone numbers, SMS codes, and generated API tokens. If an attacker can influence the environment, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or onboarding data; this is especially risky because the script performs login and token-generation flows.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The gateway request URL is built from environment-controlled base configuration and is used with an Authorization header carrying the LinkFox API key. An attacker who can set the environment can redirect billing, package, account, and order requests to a malicious endpoint and harvest the API key or manipulate downstream behavior.

Content

Scanner excerpt · skills/linkfox-aba-intelligent-query/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-ai-mode-google-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-ai-mode-google-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. In an untrusted skill environment, attacker-controlled environment variables can silently redirect these secrets to an arbitrary server, turning onboarding into credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

The gateway URL is also derived from environment variables and then used by urllib with the Authorization header populated from LINKFOX_AGENT_API_KEY. If an attacker can influence LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY, the script will send the user's API key and subsequent account/order traffic to an attacker-controlled endpoint.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request sent via urlopen includes multiple HTTP headers populated directly from environment variables, and the destination base URL is also environment-controlled through LINKFOX_TOOL_GATEWAY. In an agent/runtime setting where environment variables may be attacker-influenced, this enables SSRF-like outbound requests, metadata/header exfiltration, and misuse of the API key against arbitrary hosts.

Content

Scanner excerpt · skills/linkfox-amazon-alexa-search/scripts/amazon_alexa_search.py (reported line 80)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The requests-based POST helper ultimately sends sensitive inputs, including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, to URLs whose base is partially controlled by environment variables. In a skill execution environment, those variables may be influenced by an attacker or a compromised wrapper, enabling credential exfiltration to an attacker-controlled endpoint with little visibility to the user.

Content

Scanner excerpt · skills/linkfox-amazon-alexa-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The urllib gateway helper builds outbound requests using a base URL derived from environment variables and attaches the LinkFox API key in the Authorization header. If an attacker can influence the environment, they can redirect requests to an arbitrary server and capture the API key and account/order metadata, turning this into a straightforward secret exfiltration path.

Content

Scanner excerpt · skills/linkfox-amazon-alexa-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The request sent via urlopen includes multiple headers derived directly from environment variables, including SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME, and especially an environment-controlled base URL through LINKFOX_TOOL_GATEWAY. If an attacker can influence the runtime environment, they can redirect requests to an arbitrary host and cause sensitive metadata and the API key to be exfiltrated in outbound requests. In an agent/skill environment, environment variables are often part of orchestration and can be less trusted than hardcoded values, which makes this more dangerous than a normal local script.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/amazon_product_detail.py (reported line 80)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The POST destination is derived from environment-controlled base URLs via _login_base() and _agent_user_base(), then used in requests.post while carrying sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys in headers/bodies. If an attacker can influence environment variables, they can redirect these authentication flows to attacker-controlled infrastructure and exfiltrate credentials and session material.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The gateway URL is built from environment-controlled values and passed to urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. This creates an exfiltration path where a manipulated environment can cause authenticated requests, user/order data, and billing actions to be sent to an attacker-controlled endpoint.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

get_sts_voucher() builds the destination from LINKFOX_TOOL_GATEWAY and sends the API token in the Authorization header to that endpoint. If an attacker can influence environment variables, they can redirect the request to an untrusted host and capture the API credential, turning this into credential exfiltration via SSRF-like endpoint injection.

Content

Scanner excerpt · skills/linkfox-amazon-search-competition/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

download_media() performs outbound requests to an attacker-controlled url with only a scheme check for http/https. This enables SSRF against internal services or cloud metadata endpoints, and can also be abused to make the agent download large or sensitive content into local storage without any host allowlist, DNS/IP validation, or redirect restrictions.

Content

Scanner excerpt · skills/linkfox-amazon-search-competition/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
97% confidence
Finding

The request sent via urlopen includes attacker- or environment-controlled values such as LINKFOX_TOOL_GATEWAY and multiple metadata headers from environment variables. This can enable data exfiltration to an unintended endpoint or SSRF-like behavior if the gateway base URL is overridden, especially because request parameters and API credentials are also transmitted.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/amazon_search.py (reported line 80)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

The POST target URL is derived from environment-controlled base URLs, and the request can carry highly sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, generated API keys, and browser-like identity headers. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to attacker infrastructure and exfiltrate credentials or session material.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The gateway request URL is also constructed from environment-controlled base configuration and is used with an Authorization header containing the API key. An attacker who can set the environment can redirect account, package, and order operations to a malicious endpoint and capture the API key and related account metadata.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The request sent via urlopen includes multiple headers populated directly from environment variables, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. In an agent/runtime setting, environment variables are often influenced by surrounding orchestration, so this creates a server-side request/data exfiltration risk: secrets such as the API key and session metadata can be sent to an attacker-controlled endpoint if the gateway variable is overridden.

Content

Scanner excerpt · skills/linkfox-dld-product-search/scripts/dld_product_search.py (reported line 80)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The URL used by requests.post is derived from environment-configurable base URLs, and these requests carry sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens. If an attacker can influence environment variables in the skill runtime, they can redirect authentication traffic to attacker-controlled infrastructure and exfiltrate credentials.

Content

Scanner excerpt · skills/linkfox-dld-product-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The gateway URL passed into urllib.request.urlopen is also built from environment-controlled base configuration and is used with the Authorization header containing the API key. A compromised or user-influenced environment can redirect these authenticated requests to an attacker-controlled server, leaking the API key and enabling unauthorized account or billing actions.

Content

Scanner excerpt · skills/linkfox-dld-product-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The code accepts an arbitrary URL and fetches it with urlopen, then writes the response into local session storage. Although it restricts schemes to http/https, it still enables server-side request forgery against internal or metadata endpoints and can be abused to pull untrusted content into the workspace. In this skill context, remote media downloading is not clearly required for cross-cultural product scouting, which increases concern.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request headers include multiple environment-derived values, including the API key and session/app identifiers, and the destination host is controllable through LINKFOX_TOOL_GATEWAY. That creates an SSRF/exfiltration path where sensitive credentials and metadata can be sent to an attacker-controlled endpoint if the environment is influenced by an untrusted party.

Content

Scanner excerpt · skills/linkfox-google-trend-get-trend-by-keys/scripts/google_trends_keyword.py (reported line 80)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""