关键词选品专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches Amazon keyword research, but it bundles and instructs several high-impact behaviors that users should review before installing.

Install only if you are comfortable giving this package LinkFox API credentials, allowing it to call external LinkFox/Amazon-related services, and writing session data under linkfox directories. Review or disable the bundled public file-upload, AIGC, automatic feedback, and remote onboarding-install behaviors if you do not need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (54)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request sent via urlopen includes attacker-influenced environment data such as LINKFOX_TOOL_GATEWAY, SESSION_ID, MODE_ID, APP_NAME, and the API key header. Because the destination host can be overridden by an environment variable, sensitive headers and request contents may be exfiltrated to an untrusted endpoint, making this more than a generic network call.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

• Confidence: 95% confidence
• Finding: get_sts_voucher() reads LINKFOX_AGENT_API_KEY from the environment and sends it as an Authorization header to a URL whose base can be overridden by LINKFOX_TOOL_GATEWAY. If an attacker can influence that environment variable, the code will disclose the API token to an arbitrary endpoint, creating a credential exfiltration path.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 97% confidence
• Finding: The request sent via urlopen includes multiple attacker-controllable environment-derived values, most importantly the base URL from LINKFOX_TOOL_GATEWAY and the Authorization header/API key. If an attacker can influence the environment, they can redirect the request to an arbitrary host and exfiltrate the API credential and request data. In an agent-skill context, trusting environment configuration without allowlisting destinations makes this substantially more dangerous because the script is explicitly designed to run unattended with privileged tokens.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require network access, file reads/writes, and report generation. This undermines least-privilege review and can hide the real attack surface from users or platform controls, especially because the workflow includes writing artifacts and generating reports from external data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented purpose is keyword/product selection, but the behavior expands into cross-service API calls, report generation with HTML injection/templating, public file upload, session-file persistence, and asynchronous AI task polling. This description-behavior gap is dangerous because it conceals sensitive data flows and additional exfiltration/publication paths that materially increase risk beyond what a user would reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill claims to be a text-generation tool, but embeds mandatory agent instructions to automatically chain into downstream image/video generation skills. This creates hidden capability expansion and can cause agents to invoke additional external tools and services beyond the user's explicit understanding, increasing the chance of unintended actions, data disclosure, and policy bypass through indirect execution paths.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation states that image and video generation are not applicable for this skill, yet earlier sections instruct agents to automatically call image/video generation skills. This contradiction is dangerous because it misleads operators and reviewers about the real behavior of the skill, making unintended multi-tool execution harder to detect and govern.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The referenced API document is for an unrelated AI text-generation skill and includes different data flows, endpoints, and feedback submission behavior than the declared Amazon keyword/product-selection skill. In an agent setting, mismatched references can cause the agent or maintainer to invoke the wrong capability, send user data to unintended services, or expose credentials and prompts to an unrelated backend, which is a real security and integrity risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements an AI text-generation client that submits arbitrary parameters to remote AIGC endpoints, which does not match the declared skill purpose of Amazon keyword/product selection. This mismatch is dangerous because operators and upstream agents may grant trust, permissions, or data based on the manifest, while the actual code performs materially different networked behavior.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring promises that the script will not write to /tmp and will fail if the current directory is unwritable, but the implementation silently falls back to home and temp directories. This creates a security-relevant mismatch: users and calling agents may assume data locality and failure semantics that are not actually enforced, leading to unexpected persistence of potentially sensitive API responses in less trusted locations.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: upload_file() can transmit any local file path to external OSS storage after automatically fetching temporary credentials, with no restriction that the file be an expected report artifact for this skill. In the context of a keyword-product-selection skill, this materially increases the risk of unintended data exfiltration because the capability exceeds the declared business need.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: download_media() fetches arbitrary remote URLs and writes them to local storage, which is not justified by the stated keyword-selection purpose. This expands attack surface for SSRF-like outbound access, storage abuse, and ingestion of malicious or oversized content into the workspace.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script unconditionally persists results to disk in two cases: always to the LinkFox session directory when that environment is present, and by default to /root when no explicit output path is provided. This creates undeclared data persistence beyond the stated keyword-mining workflow, which can leak user queries, market selections, and collected output into locations the user did not explicitly approve.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file metadata describes a different skill (`linkfox-file-upload`) than the provided manifest context (`linkfox-expert-keyword-product-selection`), indicating a capability/identity mismatch. In an agent system, this can cause the wrong tool to be selected or reviewed under the wrong trust assumptions, potentially exposing an unrelated public-upload function where only keyword-selection behavior was expected.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This skill exposes public file upload to OSS and returns a publicly accessible HTTPS URL, which is unrelated to the stated keyword product-selection purpose. That unjustified capability expands the agent's attack surface and can be abused to exfiltrate local artifacts, publish sensitive files, or satisfy downstream `url`-only interfaces using data the user did not intend to make public.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script’s stated behavior is uploading arbitrary local files to public cloud storage, which is unrelated to the declared keyword/product-selection skill purpose. This capability mismatch is a strong indicator of deceptive packaging: a user invoking a market-research skill would not reasonably expect filesystem-to-public-URL exfiltration behavior, greatly increasing the risk of unauthorized data disclosure.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code uploads provided local files to Alibaba Cloud OSS and returns publicly accessible HTTPS URLs, yet this capability has no justified relationship to keyword selection or Amazon product research. In this context, the upload path functions as an exfiltration mechanism: sensitive local data can be transferred off-host and exposed via public links under the guise of an unrelated skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill for product-detail retrieval instructs the agent to download and install another skill from an external URL when onboarding guidance is missing, which expands capability far beyond the user’s request. This creates a supply-chain and scope-escalation risk: a prompt-driven workflow could induce unreviewed code/content acquisition and installation, potentially leading to execution of untrusted instructions or unauthorized changes to the agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill mandates automatic feedback API reporting for broad conditions including praise, dissatisfaction, mismatched intent, or anything that could be improved, none of which are necessary to fulfill ASIN lookup. This introduces unjustified telemetry/data exfiltration risk because user interactions and possibly query contents may be transmitted to another service without clear need, minimization, or consent.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documentation introduces a separate external feedback submission endpoint that is unrelated to the declared Keepa product-detail workflow. This expands the skill's effective capabilities to send outbound content to another service, creating a data exfiltration and scope-creep risk if user content or task context is posted without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file documents the ability to send external feedback reports, but that capability is not justified by the skill's advertised keyword/product-selection function. Undocumented secondary network actions are dangerous because they can be abused to transmit user statements, operational context, or derived analysis to a third-party endpoint outside user expectations.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The docstring states that output is always written under the current working directory and explicitly forbids /tmp, but the implementation falls back to ACPX_WORKSPACES, the user's home directory, and finally the system temp directory. This mismatch can cause sensitive API responses to be stored in locations with weaker isolation, easier discoverability, or different retention expectations than operators believe. While this is primarily a security design/documentation integrity issue rather than code execution, it can directly contribute to unintended data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill documentation instructs the agent to go beyond its stated purpose of traffic-keyword analysis by downloading and installing another skill if onboarding content is missing. This expands the trust boundary from a read/query workflow into remote code or capability acquisition, creating a supply-chain and privilege-expansion risk unrelated to the user’s original request.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Remote skill download and installation is unjustified in the context of an ASIN traffic-keyword lookup skill and introduces a direct supply-chain risk. An attacker who can influence the remote ZIP, URL, or installation path could cause execution of untrusted content or silently expand the agent’s permissions and behavior.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The reference file for a keyword-traffic lookup skill includes a separate public feedback submission API that is outside the tool’s stated purpose. Even though it is not inherently dangerous by itself, unrelated outbound API instructions expand the skill’s operational scope and can enable unexpected data exfiltration, misuse of generated content, or hidden side effects if an agent or maintainer treats all documented endpoints as approved for use.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: skills/linkfox-amazon-suggestion-miner/SKILL.md:55