低价商品专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:04 AM UTC
• Version: 1.0.1

Overview

The skill mostly supports Amazon low-price product scouting, but it also ships under-scoped abilities to create recurring tasks, handle account/billing flows, run environment-selected scripts, and persistently rewrite other agents' instructions.

Review this skill before installing. It needs a LinkFox API key, writes local session data, can consume paid credits, can create recurring tasks, and includes public upload/account/billing helpers. Only use it in a controlled workspace, confirm any scheduled task and cost, avoid untrusted LINKFOX_TOOL_GATEWAY or SELLERSPRITE_SCRIPT environment settings, and remove or quarantine the cross-agent patching and generic script-runner utilities if they are not required.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (67)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 89% confidence
• Finding: The script executes another Python file via subprocess, and the target path is not fixed: it can be overridden through the SELLERSPRITE_SCRIPT environment variable. In a skill environment, this creates a code-execution primitive where an attacker who can influence environment configuration or workspace contents can cause arbitrary Python code to run under the agent's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), params_str],
            capture_output=True,
            text=True,

• Confidence: 93% confidence
• Finding: The helper executes whatever path is supplied via --script using subprocess.run, making it a generic script launcher rather than a narrowly scoped product-selection utility. Although it avoids shell=True, it still enables execution of arbitrary local Python code if an attacker can influence arguments or reuse this helper outside its intended workflow.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 95% confidence
• Finding: The download_media function performs outbound requests to an arbitrary caller-supplied URL with urlopen after only checking for http/https. This is a classic SSRF/file-fetch primitive that can be abused to reach internal services, cloud metadata endpoints, or attacker-controlled hosts and then persist the response into the session media directory.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 95% confidence
• Finding: The subprocess working directory is derived from ACPX_WORKSPACES, an environment variable, and the script also executes a file path influenced by environment state. This means untrusted environment data directly affects code execution context, increasing the chance of running attacker-controlled files or resolving relative dependencies from an attacker-chosen directory.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 41, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 97% confidence
• Finding: SKILL_SCRIPT is sourced from SELLERSPRITE_SCRIPT and then passed to subprocess.run as the program to execute with Python. If an attacker can set that environment variable, they can point the agent at any local Python file, resulting in arbitrary code execution.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive authentication material to them via requests.post. Because these calls handle SMS login, access tokens, refresh tokens, and API-token generation, a poisoned environment can redirect credentials to an attacker-controlled host, resulting in credential theft and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header set from the API key. An attacker who can influence environment configuration can redirect these requests and exfiltrate the API key, as well as induce the tool to interact with arbitrary network services.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code builds outbound request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, access tokens, refresh tokens, UID headers, and API-token management requests, to those endpoints. If an attacker can influence the environment variables, they can redirect these requests to attacker-controlled infrastructure and capture credentials or session data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway URL is derived from environment variables and used in urllib requests that include the agent API key in the Authorization header. A poisoned environment can redirect billing, account, and order traffic to an attacker endpoint, resulting in API key exfiltration and unauthorized use of the linked account.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 89% confidence
• Finding: The outbound request includes multiple environment-derived values in headers, and the destination base URL is also controllable via LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path where secrets or session metadata can be sent to an attacker-controlled endpoint if the environment is influenced by an untrusted party.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions while its documented behavior includes shell execution, network access, MCP/tool invocation, and local file read/write. This creates a hidden-capability problem: operators and users cannot accurately assess what the skill may do, and downstream policy enforcement may be bypassed or mis-scoped.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior substantially exceeds the stated purpose of low-price product scouting, including modifying other agents' configuration files, interacting with external services, writing local artifacts, scheduling automation, and even payment/account flows. This kind of purpose drift is dangerous because a user invoking a benign-seeming scouting skill could unintentionally trigger sensitive cross-skill actions, persistence, data exfiltration, or system modification.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: Creating scheduled automation tasks introduces persistence and recurring execution beyond a one-time product-finding interaction. In context, this is more dangerous because the skill already invokes external tools and consumes credits, so unattended scheduling can lead to repeated external calls, unwanted spend, and ongoing data processing without fresh user review.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The ability to invoke a skill-creation capability is unrelated to low-price product scouting and meaningfully expands the attack surface. A scouting skill should not be able to bootstrap or modify new agent capabilities, because that can enable privilege escalation, persistence, or indirect execution of behaviors the original skill was not trusted to perform.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script is packaged in a low-price Amazon product-selection context, but it contains functionality to modify other agents' CLAUDE.md instructions by injecting new skills, triggers, workflow steps, and output rules. That is a cross-agent instruction tampering capability unrelated to the advertised purpose, which can silently alter downstream agent behavior and trust boundaries.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script persists modifications back to external CLAUDE.md files, making its changes durable and affecting future executions of other agents. Persistent instruction rewriting is dangerous because it can alter agent workflows at scale, introduce unauthorized capabilities, and make later behavior difficult to audit.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The --all mode automatically discovers and patches every agent CLAUDE.md in a workspace, enabling broad unauthorized configuration changes from one invocation. In the context of a product-selection skill, this mass-modification capability greatly increases blast radius and is inconsistent with least privilege.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring understates the script's behavior by describing it as injecting a scoring module, while the implementation also renumbers steps and modifies interaction and output sections of target agent instructions. That mismatch increases review evasion risk because operators may approve or run the tool without understanding the full extent of behavioral changes.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This file provides a broad execution primitive that can run arbitrary scripts, which exceeds the declared purpose of a low-price Amazon product scouting skill. In an agent environment, overbroad capabilities are dangerous because they expand the blast radius from data processing into arbitrary code execution on the host.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The helper can read arbitrary local files through --params-file, and its read subcommand can open any JSON file path supplied by the caller. That exceeds the business scope of the skill and may expose local data if an attacker can steer the agent into reading sensitive files that happen to be accessible and JSON-formatted.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is documented as a text-generation capability, but it also instructs the agent to automatically chain its output into downstream image/video generation skills. That expands the operational scope from passive text output to orchestration of additional actions, which can cause unintended tool invocation, policy bypass through prompt laundering, or execution of user-invisible multi-step workflows.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation presents image/video generation as 'not applicable' for this skill while simultaneously mandating chained calls into those generators. This contradiction can mislead reviewers and calling agents about the skill's true behavior, increasing the chance of unsafe invocation paths and making security controls or user expectations easier to bypass.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The referenced API documentation describes a generic AI text-generation service and feedback endpoint that do not align with the declared low-price Amazon product-selection purpose. This mismatch is dangerous because it can mask unexpected capabilities, widen the skill’s effective data-flow surface, and cause the agent to send user prompts or product-selection context to an unrelated external generation service without users or reviewers realizing it.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The onboarding document instructs the agent to handle authentication recovery, account registration, and billing/payment flows that are unrelated to the advertised low-price product selection purpose. This scope mismatch is dangerous because it expands the skill into credential/bootstrap and payment-handling behavior, increasing the chance of social engineering, unauthorized account actions, and misuse of user data under a misleading skill description.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions include script-based account creation, login via phone verification code, plan selection, and payment order generation, none of which are justified by a product-analysis skill. Embedding these capabilities in the skill creates a path for collecting sensitive information and initiating financial transactions through the agent, which materially raises abuse risk if the skill is invoked in normal operation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57