ClawHub
Back to skill

Security audit

不压库存选品专家

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly for Amazon product selection, but it bundles broader automation and agent-modifying tools that need review before installation.

Install only if you trust the publisher and intend to give this package a LinkFox API key, local file-write access, and optional scheduled-task authority. Before use, review or remove the unrelated nested skills and the CLAUDE.md patching script, keep gateway environment variables pinned to trusted LinkFox hosts, and approve any scheduled task or public file upload explicitly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (68)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None
Confidence
93% confidence
Finding
The code launches another Python script via subprocess, and the target path is not fixed: SKILL_SCRIPT can be overridden from the SELLERSPRITE_SCRIPT environment variable. Although subprocess.run is invoked without shell=True, this still enables arbitrary code execution if an attacker can influence the environment or deployment configuration, which is especially risky in an agent/runtime context that may inherit untrusted environment state.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), params_str],
            capture_output=True,
            text=True,
Confidence
95% confidence
Finding
The wrapper executes whatever path is provided via --script, making it a generic local code-execution launcher rather than a narrowly scoped helper. Even though subprocess.run is invoked without shell=True, arbitrary Python script execution is still possible if an attacker can influence the argument, which is especially risky in an agent skill that should only perform product-selection tasks.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
Confidence
95% confidence
Finding
`download_media()` performs outbound requests to any caller-supplied HTTP/HTTPS URL with no allowlist, IP-range validation, or redirect restrictions. In an agent/runtime context, this is a classic SSRF primitive that can be used to reach internal services, cloud metadata endpoints, or other sensitive network targets, while also writing attacker-chosen content to local storage.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High
Category
Data Flow
Content
call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None
Confidence
88% confidence
Finding
The subprocess working directory is derived from ACPX_WORKSPACES in the environment, and the process also executes a script whose path may be environment-controlled. An attacker who can manipulate the environment can alter execution context, module resolution, relative file access, or which files the child process reads/writes, increasing the blast radius of the subprocess call.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 81, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None
Confidence
98% confidence
Finding
SKILL_SCRIPT is initialized from os.environ.get('SELLERSPRITE_SCRIPT', ...) and then executed directly with the Python interpreter. That is a direct arbitrary-code-execution primitive for anyone who can set or influence environment variables before the agent runs.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
90% confidence
Finding
The POST destination is built from environment-controlled base URLs, and the request can carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables in the host, they can redirect these authenticated requests to attacker-controlled infrastructure and exfiltrate credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
88% confidence
Finding
The gateway URL is also derived from environment variables and used in outbound authenticated requests via urllib, with the API key attached in the Authorization header. In a compromised or multi-tenant runtime, a malicious environment override could redirect these calls and leak the user's API key or cause unauthorized billing/order actions against a fake or hostile endpoint.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
94% confidence
Finding
The script builds destination URLs from environment variables and then sends sensitive authentication material to those endpoints via requests.post. Because the same flow carries SMS-login tokens, refresh tokens, user identifiers, and API-token operations, a hostile or misconfigured environment can redirect traffic to an attacker-controlled server and exfiltrate account credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
The gateway request path uses a URL derived from environment-controlled base settings and includes the API key in the Authorization header. If an attacker can influence environment variables, they can redirect these authenticated requests to an external host and capture the API key or manipulate purchase/order operations.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
The request sent via urlopen includes multiple environment-derived headers, including SESSION_ID, MODE_ID, APP_NAME, and especially the API key in Authorization. Because the destination base URL is also overridable via LINKFOX_TOOL_GATEWAY, a hostile or misconfigured environment can redirect those secrets and metadata to an attacker-controlled endpoint, creating an exfiltration path.

Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体
Confidence
96% confidence
Finding
The script forwards multiple environment-derived values (SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME, and the API base URL via shared path logic) into an outbound HTTP request. This creates a tainted data flow from local execution context to the network and can leak sensitive metadata or route requests to an attacker-controlled endpoint if the base URL or runtime environment is manipulated. The risk is amplified because this skill's stated purpose is Amazon low-inventory product selection, yet the code performs unrelated remote task scheduling and webhook operations.

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill advertises and orchestrates powerful capabilities including shell execution, network access, file reads/writes, and delegation to other skills, yet it declares no permissions or trust boundaries. This creates a dangerous mismatch where reviewers and runtime policy may underestimate the actual attack surface, enabling hidden data access, arbitrary command execution, or unauthorized file modification through seemingly harmless product-selection flows.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The documented purpose is Amazon low-inventory product selection, but the analyzed behavior includes modifying other agents' CLAUDE.md files, injecting modules, writing reports, and invoking unrelated external services and account workflows. That scope expansion is security-relevant because it hides cross-agent tampering and broader operational side effects behind an innocuous business description, increasing the chance of unauthorized persistence or supply-chain style manipulation.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill can create, modify, delete, and query scheduled tasks via another scheduler skill even though scheduled automation is not essential to the core selection task. That increases persistence and abuse potential: a compromised or overly broad workflow could repeatedly run costly searches, exfiltrate outputs on a schedule, or perform actions after the initial user session ends.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill includes delegation to skill-creation tools unrelated to product discovery, allowing it to create or extend other skills from within the workflow. This expands the blast radius from a single analytic task to code/configuration generation, which can be abused for privilege expansion, persistence, or propagation of unsafe logic across the agent ecosystem.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The script rewrites agent documentation/prompt files even though the skill is described as an Amazon product-selection expert. That mismatch is dangerous because it gives a seemingly domain-specific skill hidden agent-modification capability, enabling unauthorized prompt injection, behavior changes, or persistence in unrelated agents if the script is run.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The --all mode enumerates agent directories and bulk-patches multiple CLAUDE.md files under a workspace path. Cross-agent modification is far beyond the stated product-selection use case and creates a scalable persistence mechanism: one execution can silently alter many agents' prompts and behavior across the environment.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code injects new behavioral instructions, triggers, command flags, workflow steps, and output rules into another agent's CLAUDE.md. This is effectively prompt/configuration tampering, which can change decision logic, tool usage, and user interaction patterns without the target agent owner's informed review, creating a strong avenue for stealthy policy bypass or later malicious extension.

Context-Inappropriate Capability

Low
Confidence
94% confidence
Finding
The code can fetch arbitrary external URLs and persist the response locally, which materially expands the skill's capabilities beyond product selection. In an agent environment this is dangerous because it enables SSRF, retrieval of malicious or oversized payloads, and untrusted file staging for downstream components.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script path is sourced from an environment variable and later executed, creating a configurable arbitrary external code execution path. In agent systems, environment configuration is often easier to influence than source code, so this substantially raises the likelihood of compromise.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The file advertises itself as a generic I/O wrapper that can persist arbitrary responses and later read arbitrary fields from disk, which is broader capability than the skill's stated low-inventory Amazon product-selection purpose. This overbreadth increases attack surface by introducing reusable data-handling and file-access primitives that could be repurposed outside the intended workflow.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script resolution logic accepts an arbitrary filesystem path and only checks that it exists as a file, enabling execution of any local Python script later in the run path. For a product-selection skill, that capability is unjustified and materially increases the chance of misuse for lateral code execution or abuse of local tooling.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The read path accepts arbitrary file locations and loads them as JSON, while the run path also writes to an arbitrary --out-dir, creating broad local file read/write capability not needed for the stated business function. In an agent environment, this can expose unrelated local artifacts or enable persistence of sensitive data in attacker-chosen locations.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This file documents APIs for an unrelated skill (`linkfox-aigc-textgen`) while the declared skill is a low-inventory Amazon product-selection expert. That mismatch can cause an agent to call the wrong external capability, sending user prompts or media to an unexpected remote service and producing behavior outside the advertised security and business scope.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The document explicitly says it is for `linkfox-aigc-textgen`, directly contradicting the enclosing skill's stated purpose. This makes the mismatch unambiguous and increases the risk of cross-skill confusion, accidental data disclosure to the wrong backend, and unauthorized capability exposure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/linkfox-task-scheduler/references/api.md:57