细分市场推荐专家

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:34 AM UTC
• Version: 1.0.0

Overview

The skill can perform the advertised niche-market analysis, but it also includes account login, API-key generation, billing/order creation, persistent local outputs, configurable credential-bearing endpoints, and automatic feedback reporting that users should review carefully.

Install only if you trust LinkFox with your market-research keywords, API credentials, phone-based onboarding data, and billing actions. Keep LinkFox endpoint environment variables unset or pointed only at trusted official hosts, require explicit confirmation before login or payment/order commands, avoid automatic feedback when conversations contain private research, and delete saved linkfox data or QR files when they are no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token requests to those endpoints. If an attacker can influence the environment, they can redirect these requests to an attacker-controlled server and capture credentials or tokens.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway URL is also environment-derived, and the code attaches the LINKFOX API key in the Authorization header before calling urlopen. A manipulated environment can therefore exfiltrate the API key and any order/account data to an attacker-controlled endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill declares no permissions, yet static analysis detected capabilities for network access, file writing, and environment access. This creates an authorization and transparency gap: operators and reviewers cannot accurately assess what the skill may do, and hidden capabilities can be abused for data exfiltration, unauthorized persistence, or writing untrusted content to disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is niche-market recommendation, but the detected behavior includes SMS OTP flows, login, API key generation, account access, subscription browsing, payment order creation, QR rendering, and payment status checks. Those are unrelated privileged actions that expand the attack surface into credential handling, account takeover, billing fraud, and secret issuance, making the skill materially more dangerous than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically report user feedback and perceived improvements via a Feedback API even though the skill’s stated purpose is niche-market analysis. This creates an unnecessary secondary data flow that can transmit user content or behavioral metadata outside the user’s immediate request, violating least-privilege and potentially user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatic Feedback API calls are context-inappropriate for a keyword niche analysis skill because they introduce outbound actions unrelated to the user’s analytical task. If triggered on dissatisfaction, praise, or anything 'that could be improved,' the agent may send broad conversational content to an external endpoint without a clear security or business need.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The reference documentation includes a separate outbound feedback API that is unrelated to the stated niche-market recommendation function. This expands the skill’s effective capability to transmit data to another external service, creating a risk of unnecessary data exfiltration or covert secondary actions if the skill later uses user content or analysis results in feedback payloads without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Documenting the ability to post external feedback without justification for the skill’s core recommendation purpose violates least privilege and creates an unnecessary outbound communication path. In an agent setting, such undocumented side effects are dangerous because they can be repurposed to leak user prompts, derived business insights, or interaction metadata to a third-party endpoint.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The onboarding document expands a niche-market recommendation skill into account recovery, registration, API-key setup, and billing/payment handling. Those capabilities are out of scope for the stated purpose and increase the chance that an operator will be induced to collect credentials or manage payments through the skill path, enlarging the attack surface and creating opportunities for abuse or accidental mishandling of sensitive data.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The instructions direct the operator to collect a user phone number, send verification codes, log in on the user’s behalf, and initiate plan ordering and payment selection. For a market recommendation skill, these are unjustified high-risk capabilities because they enable handling of personal data and commercial transactions unrelated to the core function, making social-engineering and unauthorized account actions much more plausible.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module docstring explicitly says writing to /tmp is forbidden and that failure should occur if the current directory is not writable, but the implementation falls back to ~/linkfox and the system temp directory. This can cause sensitive API responses to be persisted in unintended locations, weakening user expectations and potentially exposing data through broader filesystem access or less controlled temp storage.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill is described as providing niche-market recommendations, but the file implements account onboarding, SMS login, API-key retrieval, plan listing, order creation, and payment QR generation. That scope mismatch is dangerous because it introduces credential collection and purchasing capabilities unrelated to the claimed functionality, increasing the chance of deceptive data and payment handling.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The billing and order-management code can create purchase orders and generate payment QR codes, which is unrelated to a recommendation skill's expected behavior. In this context, unexpected purchase functionality materially raises the risk of unauthorized charges, user confusion, and abuse of the host environment for commerce workflows.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script performs SMS-based login and generates or retrieves API tokens, despite the skill being framed as a recommendation tool. Collecting phone numbers and authentication codes in a mismatched context is especially risky because it can normalize credential harvesting under false pretenses.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The trigger conditions are overly broad and can activate the skill for generic market-research or opportunity-assessment requests beyond its intended niche-analysis scope. Over-broad invocation increases the chance of unnecessary external API calls, unwanted cost incurrence, and data disclosure to the tool when another skill or a direct answer would have been more appropriate.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The document instructs the agent to translate the user’s keyword into another language automatically, without indicating user awareness, opt-in, or fidelity guarantees. While not a direct code-execution issue, this can alter user intent, mishandle proprietary search terms, and cause privacy or integrity issues if sensitive or brand-specific phrases are transformed and then transmitted to an external API.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document tells the operator to request and process the user’s phone number and verification code, but provides no privacy notice, consent flow, retention guidance, or restriction on storing/transmitting that data. This is dangerous because it normalizes collection of personal data and one-time authentication factors without safeguards, increasing the risk of privacy violations and account compromise.

Missing User Warnings

Medium

• Confidence: 73% confidence
• Finding: The order path writes payment QR image files to disk automatically in a session directory without any confirmation in this file. That creates local artifact leakage risk, especially on shared systems or agent workspaces, because payment links and order details may persist longer than users expect.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger conditions are broad, including generic phrases like '市场进入评估', 'niche recommendation', and 'sub-market analysis' without clear scoping or exclusion rules. This can cause the skill to activate in contexts where the user did not intend this workflow, leading to inappropriate tool use, irrelevant market-analysis output, or accidental handling of unrelated prompts through this pipeline.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The skill metadata and body are written to produce Chinese-language behavior by default, but there is no indication that output language follows user preference. In multilingual environments, forcing Chinese output can degrade usability, obscure important business or safety-relevant details for users who do not read Chinese, and create confusion when the user expects English or another language.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 87% confidence
• Finding: External transmission is expected for an onboarding client, but here it includes transmission of sensitive authentication material and token-related data to configurable endpoints. In combination with the environment-controlled URL behavior, this becomes a real security concern rather than a generic network call.

Static analysis

No suspicious patterns detected.