专利版权查询专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:39 AM UTC
• Version: 1.0.0

Overview

This IP-risk reporting skill is broadly coherent, but it needs Review because it can install helper skills, send feedback and task data externally, upload local files to public URLs, and retain full results locally without tight controls.

Install only if you are comfortable with product images, ASIN-derived listing data, prompts, API credentials, and session metadata being sent to LinkFox-controlled services, and with local files being uploaded as public URLs when URL-only detectors need them. Review or disable the remote onboarding install path and automatic feedback behavior, pin LINKFOX_TOOL_GATEWAY to the intended host, and avoid using the skill on confidential product imagery unless the local retention and public-upload behavior is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (219)

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

• Confidence: 85% confidence
• Finding: The code reads `LINKFOX_TOOL_GATEWAY` and `LINKFOX_AGENT_API_KEY` from the environment and sends an authenticated request to whatever gateway URL is configured. If an attacker can influence environment variables in the agent runtime, they can redirect the request to an attacker-controlled server and capture the API token or manipulate returned STS credentials, enabling further unauthorized uploads.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in headers, including the API key and session/message identifiers. Because the destination base URL is also overrideable via the LINKFOX_TOOL_GATEWAY environment variable, a compromised or untrusted runtime can redirect these secrets and identifiers to an attacker-controlled endpoint, causing credential and context exfiltration.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple environment-derived identifiers and an API key in headers, and the destination host is overridable through LINKFOX_TOOL_GATEWAY. This creates a real tainted-data egress path: if the environment is influenced by an attacker or an untrusted runtime, sensitive metadata and credentials can be exfiltrated to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple header values taken directly from environment variables, including the API key and session/app metadata, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration risk: if the execution environment is influenced by an attacker, secrets and internal identifiers can be transmitted to an arbitrary external endpoint.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 88% confidence
• Finding: The request sent via urlopen includes multiple environment-derived headers, and the destination host is also partially controllable through LINKFOX_TOOL_GATEWAY. In an agent/runtime environment, this creates a real exfiltration path for sensitive runtime metadata and API credentials to an attacker-controlled endpoint if the base URL or execution environment is influenced.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple environment-derived headers, and the base URL is also overridable by the LINKFOX_TOOL_GATEWAY environment variable. That means sensitive session/app metadata and the API key can be transmitted to an attacker-controlled endpoint if the runtime environment is manipulated, creating a real exfiltration channel.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The script builds the destination URL from the environment variable LINKFOX_TOOL_GATEWAY and then sends the API key plus session/message metadata in outbound headers. If an attacker can influence that environment variable, the request can be redirected to an arbitrary host, causing credential and metadata exfiltration. In an agent/tooling environment, environment variables are often externally controlled, so this trust boundary matters.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The script sends user-supplied parameters plus multiple environment-derived identifiers to a remote endpoint, and the destination host itself can be overridden via the LINKFOX_TOOL_GATEWAY environment variable. In an agent runtime, that creates a real exfiltration/SSRF-style risk because sensitive task data and session metadata may be transmitted to an attacker-controlled server if the environment is manipulated.

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple header values sourced directly from environment variables, and the destination base URL is also overrideable via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration path where secrets and session metadata can be transmitted to an attacker-controlled endpoint if the environment is manipulated, which is especially risky in agent/runtime environments that commonly inject sensitive context through env vars.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill includes a self-expansion path that invokes `expert-skill-creator`, which is outside the stated IP-search scope and creates a route for dynamic capability growth or behavioral changes not covered by the original trust boundary. Even if user-triggered, this broadens the attack surface and can be abused to pivot from a narrowly scoped analyst skill into generating or modifying other skills with unknown permissions or logic.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill extends beyond text generation into recovery/installation orchestration for another skill, including directing downloads from a remote URL and instructing the agent to keep trying until successful. That creates an unexpected capability boundary expansion: a user invoking a text-generation skill could trigger network retrieval and installation guidance unrelated to the original task, increasing supply-chain and privilege-abuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The documentation mandates automatic chained invocation of downstream image/video generation skills, despite this skill being presented as a text-generation tool. This hidden orchestration can cause the agent to pass model output into other tools automatically, broadening the execution scope, enabling prompt/data propagation across tools, and making user intent and consent ambiguous.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill states that image/video generation is 'not applicable' while earlier sections require automatic use of image/video generation skills. This contradiction is dangerous because it obscures the real behavior of the skill, preventing informed review and increasing the chance that downstream generation actions occur without clear operator awareness.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is packaged under an IP-risk search skill context, but the referenced API documentation is for a different skill (`linkfox-aigc-textgen`) with unrelated text-generation and feedback capabilities. This kind of skill/documentation mismatch can cause an agent to invoke unintended remote endpoints, exposing user inputs or enabling behavior outside the declared purpose, which is a supply-chain/integrity risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The feedback submission endpoint allows outbound transmission of free-form content to an external service, but this capability is unrelated to the stated IP-search function of the skill. Unjustified auxiliary network actions increase the risk of covert data exfiltration, especially if user statements, search terms, or report details are included in feedback content.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements an asynchronous AI text-generation client, while the declared skill is for IP/patent/copyright risk search and reporting. This mismatch is dangerous because agents and users may grant the skill broader trust and data access under false pretenses, causing sensitive inputs to be sent to an unrelated text-generation backend.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to download and install another skill package from a remote URL when handling auth or billing issues, which is outside the core purpose of retrieving Amazon product details. This creates a supply-chain and remote-content execution risk: a compromised URL, tampered package, or overly privileged installed skill could introduce arbitrary behavior into the agent environment.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The module documentation promises that /tmp will not be used and that an unwritable current directory will cause an error, but the implementation silently falls back to home or temporary directories. This mismatch can cause sensitive API responses to be persisted in unexpected locations, weakening operator assumptions about where data is stored and increasing accidental exposure risk.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file advertises an IP-search/reporting skill, but this script introduces a generic local-file-to-public-OSS upload capability. That mismatch is dangerous because it can be abused to exfiltrate arbitrary local files or publish unintended content, and the Chinese docstring explicitly states the URLs are publicly accessible, increasing exposure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The main logic accepts arbitrary filesystem paths from argv, uploads them using STS credentials, and prints publicly accessible URLs plus absolute local paths. In the context of an IP-search skill, this is unrelated capability that could be leveraged to exfiltrate sensitive local data or make internal artifacts public, especially because there is no binding to ASIN/image analysis or report generation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to automatically send user interactions, satisfaction signals, and perceived mismatches to a separate Feedback API that is unrelated to the primary copyright-checking function. This creates an unauthorized secondary data flow and can exfiltrate user content or metadata without explicit user consent, especially because it says to do so silently and without interrupting the user's flow.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script writes full API responses and session metadata to disk by default, which can retain potentially sensitive user inputs, copyright-search results, identifiers, and operational metadata longer than necessary. In an agent environment, persistent local storage increases exposure to later unauthorized access by other tools, users, or processes sharing the workspace.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The docstring states outputs are restricted to the current working directory and forbids /tmp, but the actual implementation falls back to the home directory and temporary directory. This mismatch can cause sensitive response data to be written to locations the operator did not expect, weakening data handling guarantees and making disclosure more likely in shared or ephemeral environments.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to download and install another skill package from an external URL when onboarding guidance is missing, expanding behavior beyond design-patent detection into remote code/package acquisition. This creates a supply-chain and unauthorized capability expansion risk, especially because the fetched package is not pinned, integrity-checked, or clearly necessary to fulfill the user's request.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The reference file documents a gun-parts policy-violation detection API, which is materially inconsistent with the skill's declared purpose of IP/patent/copyright risk analysis. This kind of capability drift is dangerous because it can cause the agent to send user inputs to an unrelated external service, producing unintended moderation/classification behavior and enabling undisclosed data use outside the expected scope.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.