低价长尾选品专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:05 AM UTC
• Version: 1.0.1

Overview

This skill is mainly an Amazon product-scouting workflow, but it bundles and exposes broader account, payment, upload, scheduling, and agent-instruction modification capabilities that need review before installation.

Review this package as a broad LinkFox agent toolkit, not just a product selector. Install only if you are comfortable with it using LinkFox API credentials, creating paid orders when billing errors occur, storing outputs and API keys locally, creating scheduled agent tasks, uploading selected files to public URLs, and having a bundled script that can modify other agents' instruction files if run.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (68)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 88% confidence
• Finding: The code executes another Python script via subprocess during normal operation, and the script path is indirectly configurable through environment state. Even though subprocess.run is called with an argument list rather than a shell string, this still enables execution of unintended code if SKILL_SCRIPT or the workspace context is manipulated, which is a meaningful code-execution boundary in an agent skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), params_str],
            capture_output=True,
            text=True,

• Confidence: 95% confidence
• Finding: The wrapper executes whatever path is supplied via --script using subprocess.run, with only an existence check and no allowlist or confinement to the skill's own entrypoint. In an agent setting, this turns the helper into a general-purpose local code execution primitive if an attacker can influence arguments, which is broader and riskier than the skill's declared product-selection purpose.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 90% confidence
• Finding: The function downloads arbitrary attacker-controlled URLs over the network and writes the response to disk. Although it restricts schemes to http/https, it still enables SSRF-style access to internal services or untrusted content retrieval if upstream callers can influence the URL.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 95% confidence
• Finding: The subprocess working directory is derived from ACPX_WORKSPACES or the current working directory without validation, creating a direct trust boundary from environment input into code execution context. An attacker who can influence these environment values can cause the subprocess to run in an attacker-controlled directory, affecting relative imports, local module resolution, and file access behavior of the invoked script.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 81, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 98% confidence
• Finding: SKILL_SCRIPT is taken from the SELLERSPRITE_SCRIPT environment variable and passed directly to the Python interpreter, allowing arbitrary script execution if that environment variable is attacker-controlled. In an agent environment, this is effectively a remote code execution primitive because the process will execute any Python file path supplied through environment configuration.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends authentication material, SMS-login tokens, and API-token management requests to those endpoints via requests.post. In a skill execution environment, an attacker who can influence environment variables can redirect traffic to attacker-controlled infrastructure and exfiltrate credentials or session tokens.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 97% confidence
• Finding: The gateway request path uses environment-derived base URLs with urllib.request.urlopen while attaching the API key in the Authorization header. If an attacker can set LINKFOX_AGENT_API_URL or fallback variables, the skill will send the API key and order/account operations to an arbitrary remote server, enabling credential theft and misuse.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends login data, access tokens, refresh tokens, group IDs, and API-token requests to those endpoints via requests.post. If an attacker can influence the environment, they can redirect these sensitive flows to an attacker-controlled server and harvest credentials or tokens; this is especially risky because the file explicitly handles onboarding and token generation.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header populated from the API key. An attacker who controls LINKFOX_AGENT_API_URL/LINKFOX_TOOL_GATEWAY can exfiltrate the API key and influence order, plan, or account requests, turning the onboarding helper into a credential-forwarding client.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and orchestrates shell, network, file read/write, env, and MCP-capable behaviors while declaring no permissions, which undermines least-privilege controls and makes operator review inaccurate. In this context, the skill chains multiple other tools, writes artifacts, and invokes scripts, so hidden capabilities materially increase the chance of unauthorized data access, file system modification, or external calls without informed approval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior extends well beyond low-price long-tail product discovery into modifying other agents' instruction files, scoring pipelines, local state management, and even onboarding/order/payment-related flows. That mismatch is dangerous because users and reviewers may grant trust based on a narrow merchandising description while the skill can affect other agents, persist data, and touch unrelated business functions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata describes a low-price long-tail product selection expert, but this script modifies unrelated agent CLAUDE.md instruction files to inject new workflow behavior. That mismatch is dangerous because it hides cross-agent instruction rewriting behind an unrelated business purpose, increasing the chance of unauthorized or unnoticed behavior changes across the workspace.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can bulk-discover agent CLAUDE.md files under /root/.linkfox/workspaces/agents and rewrite them en masse via the --all option. In the context of an end-user skill, this is a high-risk capability because it enables mass modification of agent instructions, potentially changing behavior, prompts, or tool-routing across many agents without granular review.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The script is framed as patching experts that use amazon-product-scout-agent, but its practical effect is to inject amazon-asin-dynamic-scoring instructions and alter agent behavior. This kind of understated behavior-modifying installer is risky because operators may underestimate its scope and apply it to instruction files they did not intend to change.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This shared utility can upload arbitrary local files to remote OSS storage using obtained STS credentials, which is broader than the stated product-selection purpose and creates a clear data exfiltration primitive. In an agent environment, any other component that can call this helper may transmit workspace files, reports, or secrets off-host without user awareness.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The code can fetch arbitrary external media URLs, which exceeds the stated low-price Amazon selection functionality and gives the skill unnecessary network reach. In agent contexts this increases attack surface for SSRF, tracking, and retrieval of malicious or oversized content.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The run subcommand is a generic execution wrapper that can launch arbitrary Python scripts and persist their output, which materially exceeds the narrow Amazon low-price long-tail selection function described in the manifest. Capability overreach is dangerous here because it provides reusable execution infrastructure that could be repurposed for unrelated local actions, data access, or stealthy chaining inside an agent workflow.

Description-Behavior Mismatch

Low

• Confidence: 90% confidence
• Finding: The read subcommand accepts an arbitrary file path and provides general-purpose JSON/JMESPath extraction, making it a local file inspection utility rather than a narrowly scoped product-selection feature. In an agent environment, this can be abused to probe and extract sensitive data from unrelated JSON files if the agent has filesystem access.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The file documents authentication recovery, phone-based registration, and billing/payment handling that are unrelated to the stated purpose of an Amazon low-price long-tail product selection skill. This scope expansion increases attack surface by enabling collection of credentials/PII and payment workflow handling inside a skill that should only provide product-selection assistance.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documented ability to send verification codes, log in users by phone, create payment orders, and query order status is unjustified for this skill's business purpose. Embedding account creation and payment capabilities in an unrelated skill can be abused for unauthorized account operations, phishing-style collection of user data, or monetization flows outside normal controls.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script implements a generic asynchronous AI text-generation client, while the declared skill is an Amazon low-price long-tail product selection expert. This capability mismatch is dangerous because it broadens what the skill can do beyond user and platform expectations, increasing the chance of policy bypass, prompt abuse, or hidden data handling not justified by the manifest.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The hardcoded remote endpoints are generic text-generation task APIs unrelated to the advertised long-tail product-selection use case. In skill ecosystems, such disguised general-purpose remote execution/generation is risky because it can be invoked under a misleading trust label and may process arbitrary user data or instructions outside the approved scope.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS authentication, API-key acquisition, package purchase, and payment QR generation, which is materially unrelated to the declared purpose of low-price long-tail product selection. This mismatch is dangerous because it can socially engineer users into providing phone numbers, verification codes, and payment actions under a misleading skill identity.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill contains SMS login and API token generation flows that can obtain long-lived API access on behalf of a user, despite these capabilities being unrelated to the advertised selection-expert function. In context, this is especially dangerous because users may disclose one-time codes believing they are enabling product research, while the code is actually establishing authenticated account access.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code lists purchasable plans, creates orders, and renders payment QR codes, all unrelated to the stated product-selection purpose. This creates a deceptive commerce flow inside an unrelated skill and increases the risk of unauthorized charges, phishing-like payment collection, and user confusion about what they are paying for.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57