T01 · Skill Instruction Hijacking
Error
- Location
skills/linkfox-jiimore-get-niche-info-by-keyword/SKILL.md:274- Finding
Forced Promotional Content in Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
细分市场推荐专家
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a LinkFox/Jiimore market-analysis workflow, but it also includes silent feedback reporting plus broad credential, payment, file, and endpoint behaviors that need review before installation.
Install only if you trust LinkFox with your market queries, generated reports, account/API key, and any feedback content. Avoid using custom LINKFOX_* endpoint environment variables with real credentials, do not upload private files to the OSS helper, review payment actions before approving them, and prefer storing API keys in a proper secret manager instead of shell startup files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (9)
T01 · Skill Instruction Hijacking
Error
- Location
skills/linkfox-jiimore-get-niche-info-by-keyword/SKILL.md:262- Finding
Silent External Reporting of User Statements and Intent
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/linkfox-jiimore-get-niche-info-by-keyword/scripts/onboarding.py:68- Finding
Environment-Controlled Endpoints Can Receive Authentication Credentials
- Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Authentication data is attached to requests sent to those destinations: ```python if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID if group_id: h["tid"] = group_id ``` ```python resp = _http_post( f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": { "aid": "3026344186", ...[truncated 2047 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/linkfox-jiimore-get-niche-info-by-keyword/scripts/jiimore_get_niche_info_by_keyword.py:62- Finding
Unnecessary Agent Correlation Metadata Sent to External APIs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/linkfox-file-upload/scripts/linkfox_paths.py:52- Finding
Unsanitized Session Identifier Allows Output Path Traversal
- Content
View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] ``` The untrusted value is used as a path component: ```python def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` ### Technical Analysis `SESSION_ID` is read from the environment and inserted directly into filesystem paths. It is not restricted to a safe character set, and the resulting path is not canonicalized and checked for containment beneath the intended session root. Values containing `..`, path separators, or absolute paths ca ...[truncated 1063 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/linkfox-report-generator/scripts/inject_report.py:155- Finding
Generated Reports Permit Stored HTML and JavaScript Injection
- Content
View full analysis
str: echarts_code = "" m = _ECHARTS_BLOCK_RE.search(content) if m: echarts_code = m.group(1).strip() echarts_code = _SCRIPT_OPEN_RE.sub("", echarts_code) content = _ECHARTS_BLOCK_RE.sub("", content).strip() canvas_code = "" m = _CANVAS_BLOCK_RE.search(content) if m: canvas_code = m.group(1).strip() canvas_code = _SCRIPT_OPEN_RE.sub("", canvas_code) content = _CANVAS_BLOCK_RE.sub("", content).strip() html = template.replace( "{{TITLE}}", title or "LinkFox Analysis Report", ) html = html.replace("{{LANG}}", language) html = re.sub( r".*?", "\n" + content + "\n", html, flags=re.DOTALL, ) if echarts_code: html = html.replace( "// ECHARTS_INIT_START\n // ECHARTS_INIT_END", "// ECHARTS_INIT_START\n " + echarts_code + "\n // ECHARTS_INIT_END", ) if canvas_code: html = html.replace( "// CANVAS_INIT_START\n // CANVAS_INIT_END", "// CANVAS_INIT_START\n " + canvas_code + "\n // CANVAS_INIT_END", ) ``` ### Technical Analysis The report generator embeds caller-controlled HTML directly into the template. It also extracts content between chart markers and places it directly into JavaScript execution contexts. Removing opening and closing `- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/linkfox-file-upload/scripts/linkfox_paths.py:476- Finding
HTTP Media Downloader Allows SSRF and Unbounded Disk Writes
- Content
View full analysis
Optional[str]: if not url or not isinstance(url, str): return None if not url.startswith("http://") and not url.startswith("https://"): print( f"[download_media] Unsupported URL scheme: {url[:80]}", file=sys.stderr, ) return None req = Request( url, headers={"User-Agent": "LinkFox-Skill/2.0"}, ) try: with urlopen(req, timeout=timeout) as resp: with open(tmp_path, "wb") as f: while True: chunk = resp.read(65536) if not chunk: break f.write(chunk) ``` ### Technical Analysis The downloader validates only that the input begins with `http://` or `https://`. It does not reject: - Loopback addresses. - Private or carrier-grade NAT networks. - Link-local addresses. - Cloud metadata endpoints. - IPv6 local and reserved addresses. - DNS rebinding. - Redirects to restricted destinations. The download loop also has no maximum byte count. A remote server can send an extremely large or indefinite response until disk capacity, quota, timeout, or another external limit is reached. ### Attack Path 1. An attacker supplies a media URL accepted by a workflow using `download_media`. 2. The URL points directly to an internal service or redirects to one. 3. The skill process issues the request from its network environment. 4. Intern ...[truncated 564 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/linkfox-jiimore-get-niche-info-by-keyword/scripts/onboarding.py:484- Finding
Onboarding Workflow Exposes Complete API Keys Through Standard Output
- Content
View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} API key obtained successfully", file=sys.stderr, ) return 0 return 1 ``` ### Technical Analysis The onboarding command emits the complete API key to standard output as JSON. Standard output is commonly captured by: - Agent transcripts. - Shell redirection. - CI/CD logs. - Terminal scrollback. - Process orchestration and debugging systems. - Command-history wrappers. Although the user needs a way to configure the key, printing the full credential into a broadly captured channel is not a secure secret-delivery mechanism. The accompanying onboarding documentation also recommends placing the key in shell startup files, which creates long-lived plaintext storage. ### Attack Path 1. The user completes SMS login. 2. The onboarding service returns or generates an API key. 3. The script inserts the complete key into the result object. 4. `_emit` prints the key to standard output. 5. A logging, transcript, terminal, or orchestration system retains the output. ...[truncated 360 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
skills/linkfox-file-upload/SKILL.md:32- Finding
Runtime Installation Instructions Use Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (91)
Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"}) try: with _lf_urlopen(req, timeout=timeout) as resp: if guessed_ext == "bin": ct = resp.headers.get("Content-Type", "") if "mp4" in ct:
Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } req = Request(url, data=data, headers=headers, method="POST") try: with urlopen(req, timeout=HTTP_TIMEOUT) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 94% confidence
- Finding
The code builds destination URLs from environment variables and then sends sensitive authentication material to them via requests.post. Because this file handles SMS login, access tokens, refresh tokens, and API-key generation, a malicious or misconfigured environment can silently redirect these secrets to an attacker-controlled host, causing credential exfiltration and account compromise.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The gateway request path uses a URL derived from environment variables and sends the API key in the Authorization header via urlopen. If an attacker can influence the runtime environment, they can redirect paid account, order, and user-info traffic to an arbitrary server and capture the API key and related account data.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The download_media function accepts an arbitrary URL and fetches it with urlopen, only checking that it starts with http:// or https://. This creates a server-side request forgery primitive that can reach attacker-chosen hosts, including internal services or cloud metadata endpoints, and write the response to local storage. In the context of a niche-market recommendation skill, this network/file capability is unrelated to the stated purpose and therefore more suspicious and dangerous.
- Content
python req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"}) try: with urlopen(req, timeout=timeout) as resp: # 从 Content-Type 进一步修正扩展名 if guessed_ext == "bin": ct = resp.headers.get("Content-Type", "")
Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 94% confidence
- Finding
The request includes multiple headers taken directly from environment variables, and the destination host is also overrideable via LINKFOX_TOOL_GATEWAY. In an agent/runtime environment where these variables may be influenced by untrusted context or plugins, this can exfiltrate sensitive execution metadata and the API key to an attacker-controlled endpoint, making the network sink materially dangerous.
- Content
python method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 92% confidence
- Finding
The code builds request destinations from environment-controlled base URLs and then sends sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and API-token generation requests, to those endpoints. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect these requests to attacker-controlled infrastructure and capture credentials or tokens.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The gateway URL is also derived from environment variables and used in urlopen with the Authorization header populated from the local API key. An attacker who can set LINKFOX_AGENT_API_URL or related variables can exfiltrate the API key and influence account, package, and order operations by redirecting traffic to a malicious endpoint.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={"Content-Type": "application/json", "Authorization": api_token}, ) try: with urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode()) break except urllib.error.HTTPError as e:
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={"Content-Type": "application/json", "Authorization": api_token}, ) try: with urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode()) break except urllib.error.HTTPError as e:
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 97% confidence
- Finding
download_media accepts an arbitrary caller-supplied URL and fetches it with urlopen, only checking that the scheme is http/https. This creates an SSRF-capable network primitive that can be abused to access internal services, metadata endpoints, or attacker-controlled hosts, and the downloaded content is then persisted locally. In the context of a niche-market recommendation skill, this capability is not justified and increases risk.
- Content
python req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"}) try: with urlopen(req, timeout=timeout) as resp: # 从 Content-Type 进一步修正扩展名 if guessed_ext == "bin": ct = resp.headers.get("Content-Type", "")
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Directory creation, index maintenance, metadata recording, env-token usage, STS voucher retrieval, OSS upload, and arbitrary URL download represent substantial hidden system and network capabilities. In this context, that makes the skill more dangerous because the stated business-analysis purpose gives no reason for broad storage, transfer, and fetch operations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file is API documentation for
linkfox-aigc-textgen, but the declared skill under review is a niche-market recommendation skill. This kind of cross-skill reference can cause an agent to invoke the wrong capability, send user inputs to an unrelated external service, and mishandle data or permissions outside the expected trust boundary.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation introduces authentication recovery, phone-based registration, API key handling, and billing/payment workflows that are unrelated to the stated niche-market recommendation purpose of the skill. This kind of scope expansion is dangerous because it normalizes collecting credentials/PII and directing users into account/payment flows through the skill, increasing the chance of phishing, data misuse, or unauthorized monetization.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs users to provide a phone number to a script, obtain SMS codes, log in, list plans, create orders, and select payment methods, none of which are necessary for a market-recommendation skill. In this context, the capability mismatch makes the skill materially more dangerous because it can be used to collect personal data and steer users into paid transactions outside the expected trust boundary.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file implements an async AI text-generation client, while the declared skill is for niche-market discovery and recommendation. This capability mismatch is dangerous because it expands the skill's effective authority beyond user expectations and review scope, enabling hidden data egress or unintended content-generation operations under an unrelated manifest.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file implements account onboarding, SMS authentication, API-key retrieval, plan listing, purchasing, and order querying, which is materially unrelated to a niche-market recommendation skill. Such scope mismatch is dangerous because it creates an unexpected credential and commerce collection surface that users and reviewers would not reasonably expect from the declared skill purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code can create orders and render payment QR codes, enabling a direct purchase workflow inside a skill that is supposed to provide market recommendations only. In this context, hidden commerce behavior is especially risky because it can pressure or trick users into financial transactions unrelated to the advertised functionality.
- Content
Static analysis
No suspicious patterns detected.