关键词挖掘专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:06 AM UTC
• Version: 1.0.1

Overview

This looks like a real LinkFox keyword-mining workflow, but it bundles broader account, upload, scheduling, and skill-creation powers that should be reviewed before installation.

Install only if you intend to use LinkFox cloud services and are comfortable sending ASINs, reviews, prompts, generated reports, and an API key to LinkFox/Amazon-related endpoints. Do not set LinkFox gateway environment variables to untrusted hosts, review any public upload before approving it, and be careful with recurring tasks or skill-creation requests because they persist beyond a single analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (166)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends authentication material, phone numbers, SMS codes, and API-token workflow data to those endpoints. If an attacker can influence environment variables, they can redirect requests to attacker-controlled servers and exfiltrate credentials or induce SSRF-like behavior; this is especially dangerous because this file performs login and token issuance.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway URL is derived from environment variables and used in urlopen with the Authorization header populated from the API key. An attacker who controls the runtime environment can redirect these requests to a hostile endpoint and capture bearer credentials or abuse the process as a network client to arbitrary hosts.

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The script sends arbitrary input parameters plus environment-derived metadata headers (`SESSION_ID`, `MODE_ID`, `APP_NAME`) and an API key to a remote service whose base URL can be overridden by the `LINKFOX_TOOL_GATEWAY` environment variable. In a hostile or misconfigured runtime, this can redirect requests and sensitive prompt/task data to an attacker-controlled endpoint, creating credential and data exfiltration risk.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The POST target URL is derived from helper functions that read environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, and this request can carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens. If an attacker can influence the environment, the script will send authentication material to attacker-controlled infrastructure, enabling credential theft and account takeover.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway request URL is built from environment-controlled base URLs and then used with urlopen while attaching the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect requests to a malicious server and harvest the API key, user metadata, and order-related information.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data and bearer/API tokens, to those endpoints via requests.post. If an attacker can influence environment variables in the runtime or packaging context, they can redirect credentials and issued tokens to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway helper constructs urllib requests from environment-derived base URLs and attaches the API key in the Authorization header before calling urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related variables can force outbound requests containing the API key and billing/order operations to a malicious server, leading to secret leakage and unauthorized transaction manipulation.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request sent to the external gateway includes multiple environment-derived headers, and the destination base URL is also overrideable via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration path for sensitive runtime metadata and the API key to any attacker-controlled endpoint if the environment is influenced by an untrusted party.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 89% confidence
• Finding: The POST destination is built from environment-controlled base URLs, so whoever controls runtime configuration can redirect login or token-bearing requests to an attacker-controlled endpoint. Because these requests include SMS login data, access tokens, refresh tokens, uid/tid headers, and token-generation responses, this creates SSRF-style exfiltration and credential leakage risk rather than a harmless configuration option.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The urllib request target is likewise derived from environment variables and is called with the Authorization header containing the LinkFox API key. An attacker who can influence environment variables can redirect package, account, or order API calls to a rogue server and capture the API key and associated account data.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 95% confidence
• Finding: `download_media()` accepts an arbitrary `url` and performs a server-side HTTP fetch with `urlopen`, then writes the response to local storage. Although it restricts schemes to http/https, it still enables SSRF-style access to attacker-controlled destinations, internal services, or large/untrusted content downloads, which is unrelated to the stated Amazon keyword mining purpose.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, API keys, and user identifiers to those endpoints. If an attacker can influence environment variables, the script can be redirected to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request uses a URL derived from environment variables and attaches the Authorization header populated from the user's API key. An attacker who controls the environment can redirect this request to an arbitrary server and capture the bearer credential, enabling unauthorized API use and possible billing abuse.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes environment-derived values in headers, including the API key and session metadata, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path: if the environment is influenced by an attacker, secrets and session identifiers can be sent to an arbitrary endpoint over the network.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as SMS login payloads, access tokens, refresh tokens, and API-token requests to those endpoints. In an agent/skill environment, environment variables can be influenced by the host or deployment, so this creates an SSRF/exfiltration path that can redirect credentials to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is derived from environment variables and used in urllib requests with the Authorization header populated from the API key. If the base URL is changed, the script will transmit the API key and order/account operations to an attacker-selected endpoint, enabling credential theft and unauthorized API actions.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request sent via urlopen includes environment-derived values in headers, including the API key and routing/base URL inputs. Because LINKFOX_TOOL_GATEWAY is attacker-controllable through the environment, the script can be redirected to an arbitrary host and will transmit the Authorization header there, causing credential exfiltration and potentially leakage of session metadata.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST destination is derived from environment-controlled base URLs via helper functions, and the request can carry sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables in the host/runtime, this script becomes an exfiltration primitive that silently sends credentials to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway URL is built from environment-controlled values and then used in urlopen with the API key attached in the Authorization header. In a compromised or manipulated execution environment, this allows redirection of authenticated requests and billing/order actions to attacker-controlled endpoints, exposing secrets and enabling unauthorized transaction flow manipulation.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The script builds a request using environment-controlled values, including the gateway base URL and several identifier headers, and then sends the request with urlopen. Because LINKFOX_TOOL_GATEWAY can fully redirect the destination, an attacker who can influence the environment can cause the skill to exfiltrate the API key, request payload, and session metadata to an arbitrary server.

Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体

• Confidence: 93% confidence
• Finding: The request sent via urlopen includes attacker-influenced destination/configuration through environment-derived values, especially the API base resolved from shared path logic and identity/context headers sourced from environment variables. In an agent environment, this can enable SSRF-like exfiltration of the bearer API key and session metadata to an attacker-controlled endpoint if LINKFOX_TOOL_GATEWAY or shared base-url resolution is manipulated.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documents use of powerful capabilities such as network access, file read/write, shell, and environment access, yet no permissions are explicitly declared. This creates an opaque trust boundary where reviewers and runtime policy may not accurately reflect the skill’s effective power, increasing the chance of overprivileged execution or unsafe tool invocation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest presents the skill as a keyword-mining assistant, but the workflow includes far broader behaviors such as login/API-key acquisition, payments, file upload, task scheduling, report generation, multimodal processing, and developer tooling. This mismatch can mislead operators and users about the real attack surface, causing them to authorize or trust a skill that can perform materially riskier actions than expected.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The workflow includes converting local reports or keyword files into publicly accessible URLs via file upload, which exceeds the stated keyword-research scope and introduces data exposure risk. Analysis artifacts may contain proprietary market research, customer data, or internal business strategy that could be unintentionally published.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The skill includes instructions to create or modify other skills via a skill-creator tool, which is unrelated to keyword mining and can act as a privilege-escalation or lateral-expansion path. A content-analysis skill should not be able to transition into software generation or workflow modification without a separate, tightly scoped trust boundary.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57