ClawHub
Back to skill

Security audit

低价商品专家

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an Amazon product-research workflow, but it includes under-scoped credential routing and a bundled script that can persistently rewrite agent instruction files.

Install only if you trust the LinkFox environment and publisher, can control the process environment, and are comfortable with LinkFox API keys, product queries, generated files, and scheduled prompts being sent to LinkFox services. Avoid custom gateway/login endpoint environment variables, do not store API keys in shell startup files if possible, and do not run the CLAUDE.md patcher unless you intentionally want persistent agent-instruction changes.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T02 · Agent Memory Poisoning

Error
Location
skills/amazon-asin-dynamic-scoring/scripts/patch_scoring_to_agent.py:256
Finding

Undisclosed Persistent Modification of Agent Instruction Files

Content
View full analysis
[ ...]") print(" python3 patch_scoring_to_agent.py --all (auto-find all agents)") sys.exit(1) if sys.argv[1] == "--all": # Auto-find all CLAUDE.md files in agents directory agents_dir = Path("/root/.linkfox/workspaces/agents") targets = sorted(agents_dir.glob("*/CLAUDE.md")) # Also check workspace root root_claude = Path("/root/.linkfox/workspaces/CLAUDE.md") if root_claude.exists(): targets.append(root_claude) else: targets = [Path(p) for p in sys.argv[1:]] patched = 0 skipped = 0 for t in targets: if patch_file(str(t)): patched += 1 else: skipped += 1 ``` The injected content adds new intent triggers, workflow instructions, Skill invocations, output requirements, and recommendations to the target Agent configuration. ### Technical Analysis The scoring Skill declares itself to be a pure scoring engine and documents `scripts/score_asins.py` as its automation interface. The separate patching utility is not documented as part of the scoring workflow. When invoked with `--all`, the utility searches a fixed Agent workspace hierarchy for `CLAUDE.md` files and rewrites them. These files constitute persistent Agent instructions that can influence future sessions. The modifications are not limited to transient scoring output: they add rules controlling when the Agent should initiate scoring, which Skills ...[truncated 2131 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/linkfox-file-upload/scripts/linkfox_paths.py:226
Finding

Authentication Credentials Can Be Forwarded to Arbitrary Environment-Controlled Endpoints

Content
View full analysis
str: """tool-gateway base address.""" return ( os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com" ).rstrip("/") def get_sts_voucher() -> dict: import urllib.error from urllib.request import urlopen, Request base = _get_agent_base() api_token = os.environ.get("LINKFOX_AGENT_API_KEY") or "" url = f"{base}/oss/getStsVoucherByAPI" last_exc: Exception = RuntimeError("unknown error") body: dict = {} for attempt in range(3): if attempt: time.sleep(1 << (attempt - 1)) req = Request( url, method="POST", data=b"{}", headers={ "Content-Type": "application/json", "Authorization": api_token, }, ) try: with urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode()) break ``` Several API clients also forward execution metadata: ```python heade ...[truncated 3747 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/linkfox-aigc-textgen/scripts/onboarding.py:454
Finding

Generated API Keys Are Exposed Through Standard Output and Plaintext Shell Configuration

Content
View full analysis
dict: hdr = _headers( "agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id, ) for path, source in ( ("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated"), ): resp = _http_post( f"{_agent_user_base()}{path}", {"id": group_id}, hdr, ) if "_error" in resp: return { "error": ( f"{path.rsplit('/', 1)[-1]}: " f"{resp.get('_body') or resp['_error']}" ) } tok = _extract_token(resp) if tok: return { "api_key": tok, "source": source, } return { "error": ( "generateApiToken: token was not returned: " f"{json.dumps(resp, ensure_ascii=False)}" ) } def login_and_get_key(phone: str, code: str, channel: str) -> dict: # Authentication and team lookup omitted here. tok = _get_or_generate_api_token( lg["access_token"], lg["user_id"], info["group_id"], ) if "error" in tok: return { "error": tok["error"], "phone": masked, } return { "api_key": tok["api_key"], ...[truncated 3089 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
skills/linkfox-file-upload/SKILL.md:32
Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (150)

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/amazon-product-scout-agent/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python
req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and derived API tokens, to those endpoints with requests.post. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect authentication traffic and credentials to an attacker-controlled server, resulting in credential theft and account compromise.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The gateway request path uses a base URL derived from environment variables and sends the bearer API key in the Authorization header via urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related variables can exfiltrate the API key and manipulate package, order, or account responses, enabling account abuse, fraudulent billing flows, or service impersonation.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The download_media function performs network requests to an attacker-controlled URL and writes the returned content to local storage. Although it restricts schemes to http/https, it does not validate host allowlists, size limits, redirect behavior, or content safety, creating a server-side request forgery and untrusted file ingestion risk.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The POST target URL is derived from environment-controlled base URLs, and this function sends sensitive data including SMS login credentials, access tokens, refresh tokens, and group identifiers. If an attacker can influence the environment, they can redirect these requests to an arbitrary host and exfiltrate authentication material. In the context of a product-selection skill, this onboarding/login behavior is especially unjustified and increases risk.

Content

Scanner excerpt · skills/linkfox-sellersprite-product-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The gateway request uses a URL built from environment-controlled base configuration and attaches the API key in the Authorization header. An attacker who controls the environment can redirect requests to a malicious endpoint and capture the API key, user/account data, and order information. Because this file also supports plan listing, order creation, and payment state queries, the exposed credential can enable unauthorized account actions.

Content

Scanner excerpt · skills/linkfox-sellersprite-product-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request sent to the remote gateway includes multiple values taken directly from environment variables, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. This creates a real data-exfiltration and SSRF-style risk: a caller or compromised runtime can redirect requests to an attacker-controlled host and cause API keys, session identifiers, and user-supplied query data to be transmitted externally.

Content

Scanner excerpt · skills/linkfox-sellersprite-product-search/scripts/sellersprite_product_search.py (reported line 80)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/amazon-product-scout-agent/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

download_media performs outbound requests to an attacker-controlled url with only a scheme check. This enables SSRF to internal or metadata endpoints and allows untrusted remote content to be written into the session workspace, which is broader capability than the skill’s stated low-price product-selection purpose.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python
req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 249, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The script forwards multiple environment-derived values into an outbound HTTP request, including a base URL resolved from configuration and headers such as SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME. If an attacker can influence the environment or the helper that resolves the gateway URL, the skill can be made to exfiltrate execution metadata and the API key to an attacker-controlled endpoint, which is especially risky in an agent/runtime environment where environment variables are part of the trust boundary.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/task_scheduler.py (reported line 264)May include surrounding context.

python
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Task creation, update, deletion, status changes, webhook notifications, external scheduler API calls, and response persistence go beyond a simple analyst skill and introduce automation risk. In an agent context, persistent scheduled execution can turn a one-time prompt into ongoing actions, amplifying any misconfiguration or malicious workflow over time.

Content

No source excerpt is available for this finding.