ClawHub
Back to skill

Security audit

专利版权查询专家

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its IP-search/report purpose, but it needs Review because it can send conversation feedback and credentials/account data over configurable network endpoints while also storing full results locally.

Install only if you are comfortable sending ASINs, product images, patent queries, generated prompts, and possible feedback text to LinkFox services. Use a clean environment with no custom LINKFOX_* gateway URLs unless you control them, treat LINKFOX_AGENT_API_KEY as a secret, avoid running in shared or synced workspaces, and do not upload private files or images unless they can be publicly accessible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
skills/linkfox-zhihuiya-description-data-translated/SKILL.md:116
Finding

Automatic Feedback Instructions Can Disclose User Conversation Content

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-zhihuiya-description-data-translated/scripts/zhihuiya_description_translated.py:37
Finding

Environment-Overrideable API Destinations Can Exfiltrate Credentials

Content
View full analysis
str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key 未配置", file=sys.stderr, ) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "Accept": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` The onboarding flow similarly allows the login and Agent-user destinations to be replaced: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", ...[truncated 2964 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/linkfox-aigc-textgen/scripts/onboarding.py:468
Finding

Onboarding Prints Newly Generated API Keys to Standard Output

Content
View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` ### Technical Analysis API keys are bearer credentials and should be handled as secrets. Printing a key in JSON to standard output makes it available to any layer that captures process output, including: - Agent conversation context - Terminal scrollback - CI and orchestration logs - Shell redirection - Debugging or observability systems - Parent processes invoking the script - Shared session transcripts Masking the phone number does not mitigate exposure of the more sensitive API key. The behavior exceeds minimum privilege because downstream code needs access to the credential, but users and logging systems do not need the full plaintext value. ### Attack Path 1. A user invokes the `login` onboarding command with a phone number and SMS code. 2. The script authenticates the user and obtains or generates an API key. 3. `login_and_get_key` places the complete key in the returned dictionary. 4. `_ ...[truncated 714 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/linkfox-zhihuiya-description-data-translated/scripts/zhihuiya_description_translated.py:88
Finding

Complete API Responses Are Persisted in Cleartext with Unsafe Default File Handling

Content
View full analysis
CACHE_TTL_SEC: return None try: with open(path, encoding="utf-8") as f: payload = json.load(f) if isinstance(payload, dict): payload.setdefault("_cache", {})["hit"] = True return payload except (OSError, json.JSONDecodeError): return None def _save_cache(path, payload): try: with open(path, "w", encoding="utf-8") as f: json.dump(payload, f, ensure_ascii=False, indent=2) except OSError: pass ``` The complete response is also written to a session output file: ```python serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = int(time.time()) out_path = _resolve_output_path(ts) try: with open(out_path, "w") as f: f.write(serialized) print(f"Saved full response: {out_path} ({len(serialized)} bytes)") if result.get("_cache", {}).get("hit"): print(f"Cache hit: {cache_path}") except OSError as e: print(f"Failed to save to {out_path}: {e}", file=sys.stderr) ``` The Skill directs that the full response must always be persisted ...[truncated 2456 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (675)

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The function downloads attacker-controlled URLs over arbitrary HTTP(S) and writes the response to disk without host allowlisting, content validation, or SSRF protections. In an agent environment, this can be abused to make outbound requests to internal services or fetch untrusted payloads, which is broader and riskier than the skill’s stated IP-search/reporting purpose.

Content

Scanner excerpt · skills/ip-full-detection/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The script sends API keys and multiple environment-derived metadata headers (SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME) to a network endpoint whose base URL can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. If that variable is manipulated, requests and credentials can be redirected to an attacker-controlled server, causing secret exfiltration and leakage of workflow metadata.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The code builds destination URLs from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints via requests.post. In a skill context, environment variables are part of the deployment trust boundary and may be attacker-controlled or misconfigured, enabling silent SSRF-like redirection and credential exfiltration to an arbitrary host.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The gateway request path uses _agent_base() sourced from environment variables and then calls urlopen with the API key in the Authorization header. If the base URL is redirected to an attacker-controlled endpoint, the skill will transmit the LinkFox API key and business operations such as account/package/order requests to that host, causing credential leakage and unauthorized transaction flow.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends phone numbers, SMS codes, access tokens, refresh tokens, and token-generation requests to those URLs. If an attacker can influence the environment, they can redirect these highly sensitive authentication flows to an attacker-controlled server and capture credentials or API keys.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The gateway URL is also environment-controlled and is used for authenticated API calls with the API key placed in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect requests and exfiltrate the API key or manipulate package/order responses, leading to credential theft and fraudulent purchase flow abuse.

Content

Scanner excerpt · skills/linkfox-amazon-product-detail/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

download_media() accepts an arbitrary caller-supplied URL and fetches it with urlopen after only checking for http:// or https://. In an agent/runtime environment this creates a classic SSRF primitive that can be used to reach internal services, cloud metadata endpoints, or other unintended network locations, and the downloaded response is then persisted locally.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/ip-full-detection/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
97% confidence
Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material to those endpoints via requests.post. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect SMS-login tokens, refresh tokens, and API-token generation traffic to an attacker-controlled server, causing credential exfiltration and account takeover.

Content

Scanner excerpt · skills/linkfox-ruiguan-copyright-detection/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The gateway client uses environment-derived base URLs to construct Request objects passed to urlopen while attaching the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect traffic and capture the API key or manipulate billing/order operations, leading to credential theft and unauthorized account actions.

Content

Scanner excerpt · skills/linkfox-ruiguan-copyright-detection/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

The script builds request destinations from environment variables and then sends sensitive login material, SMS codes, access tokens, and API keys to those endpoints via requests.post. If an attacker can influence the environment or deployment configuration, they can redirect these calls to attacker-controlled servers and exfiltrate credentials; in this skill, that risk is amplified because onboarding explicitly handles account login and API token issuance.

Content

Scanner excerpt · skills/linkfox-ruiguan-detection-patent-design/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The gateway URL is derived from environment variables and used to construct urllib requests that carry the agent API key in the Authorization header. A malicious or compromised runtime can point this base URL at an attacker-controlled service, causing silent credential leakage and potentially exposing account, package, and order operations; because this script also supports billing and order creation, misuse can lead to both account compromise and fraudulent transactions.

Content

Scanner excerpt · skills/linkfox-ruiguan-detection-patent-design/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The script allows service base URLs to be overridden by environment variables and then sends phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those URLs via requests.post. In a skill/onboarding context, that creates a strong SSRF/exfiltration path: a manipulated runtime environment can redirect credential-bearing traffic to attacker-controlled infrastructure without user visibility.

Content

Scanner excerpt · skills/linkfox-ruiguan-gun-parts-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The gateway request path uses an environment-derived base URL and sends Authorization headers containing the agent API key through urllib.request.urlopen. If an attacker can influence environment configuration, they can redirect authenticated API traffic and harvest API keys or capture order/account data, which is especially risky in an onboarding script handling credentials and billing flows.

Content

Scanner excerpt · skills/linkfox-ruiguan-gun-parts-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The script performs an HTTP PUT of arbitrary local file contents to a presigned URL obtained from a remote service, then sets the object ACL to public-read. Because the upload target is fully determined by the returned presigned URL and there is no validation that it belongs to an expected storage domain, a compromised or misconfigured gateway could direct sensitive local content to an unintended external destination.

Content

Scanner excerpt · skills/linkfox-ruiguan-gun-parts-search/scripts/upload_image.py (reported line 106)May include surrounding context.

python
)

    try:
        with urlopen(req, timeout=120) as response:
            if response.status not in (200, 201):
                print(f"Upload failed with status: {response.status}", file=sys.stderr)
                sys.exit(1)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The code builds request destinations from environment variables via _login_base() and _agent_user_base(), then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs. In an agent or hosted environment where env vars can be influenced, this becomes an exfiltration channel or SSRF-style redirect of credentialed traffic to attacker-controlled infrastructure.

Content

Scanner excerpt · skills/linkfox-ruiguan-text-trademark-detection/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The gateway URL is derived from environment variables and then passed into urllib Request/urlopen together with the Authorization header containing the LinkFox API key. If an attacker can alter LINKFOX_AGENT_API_URL or related variables, authenticated requests for account info, package data, and order actions can be redirected to a malicious server, leaking credentials and enabling unauthorized billing-related actions.

Content

Scanner excerpt · skills/linkfox-ruiguan-text-trademark-detection/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication and credential traffic to attacker-controlled servers, causing credential theft and account compromise.

Content

Scanner excerpt · skills/linkfox-ruiguan-trademark-graphic-detection/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The gateway request uses a URL assembled from environment-controlled configuration and sends the API key in the Authorization header via urlopen. A manipulated environment can exfiltrate the user's API key and redirect subsequent privileged account, package, and order operations to attacker infrastructure.

Content

Scanner excerpt · skills/linkfox-ruiguan-trademark-graphic-detection/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The code builds destination URLs from environment variables and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints via requests.post. If an attacker can influence the process environment, they can redirect authentication traffic to attacker-controlled servers and exfiltrate credentials and tokens. The skill context increases risk because this file explicitly handles login and token issuance flows, so the transmitted data is highly sensitive.

Content

Scanner excerpt · skills/linkfox-ruiguan-utility-patent-detection/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The gateway helper constructs outbound requests using a base URL sourced from environment variables and includes the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or a fallback variable can redirect these requests to an attacker-controlled endpoint and capture the API key or manipulate package/order responses. This is especially dangerous here because the code also supports order creation and payment-related actions.

Content

Scanner excerpt · skills/linkfox-ruiguan-utility-patent-detection/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code