投机选品专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:04 AM UTC
• Version: 1.0.1

Overview

The core product-scouting workflow is mostly coherent, but the package also includes under-disclosed high-impact account, payment, scheduling, upload, feedback, and cross-agent modification capabilities.

Install only if you intend to trust this package with LinkFox credentials, paid account workflows, recurring task creation, local session persistence, and bundled auxiliary skills beyond product scouting. Before use, review the scheduler, onboarding/billing, public upload, automatic feedback, and CLAUDE.md patching behavior, and avoid setting endpoint or script-path override environment variables unless you control the runtime.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (53)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 96% confidence
• Finding: The code executes another Python script via subprocess using a script path derived from an environment variable and a working directory also derived from an environment variable. Although it avoids shell=True, this still enables arbitrary code execution if an attacker can influence SELLERSPRITE_SCRIPT or ACPX_WORKSPACES, which is especially risky in shared agent/runtime environments.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 98% confidence
• Finding: The subprocess cwd is taken directly from ACPX_WORKSPACES (falling back to the current directory), so environment-controlled state influences code execution context. An attacker who controls this variable can redirect execution into an attacker-controlled workspace, affecting imports, relative file access, and behavior of the spawned script.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 81, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 99% confidence
• Finding: SKILL_SCRIPT is sourced from the SELLERSPRITE_SCRIPT environment variable and then executed with the Python interpreter. This is a direct arbitrary code execution path: any attacker who can set that variable can cause the agent to run an arbitrary local script with the agent's privileges.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication traffic and credentials to attacker-controlled infrastructure, creating a straightforward exfiltration channel.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway URL is derived from environment variables and used by urllib to send authenticated requests with the API key in the Authorization header. An attacker who controls the environment can redirect billing, account, or order traffic to a rogue endpoint and capture API credentials or manipulate responses, affecting both confidentiality and integrity.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The POST target is derived from helper functions that read environment variables for base URLs, so a hostile runtime can redirect login and token-bearing requests to an attacker-controlled endpoint. Because these requests include SMS login data, access tokens, refresh tokens, and derived account metadata, this creates a credible credential exfiltration channel rather than a purely theoretical configuration issue.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The gateway request URL is also built from environment-controlled base URLs and then used in urlopen with the Authorization header populated from the LinkFox API key. If an attacker can influence environment variables, they can redirect authenticated gateway traffic and capture API keys or induce unauthorized actions against a fake or alternate service.

Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体

• Confidence: 91% confidence
• Finding: The script forwards multiple environment-derived values into outbound HTTP headers, including SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME, and also uses a base URL resolved from shared code/environment. This creates a tainted environment-to-network flow that can leak sensitive runtime metadata to a remote service or an attacker-controlled endpoint if configuration is manipulated.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands, reads/writes files, uses networked sub-skills, and appears to maintain state/export artifacts, yet it declares no permissions. This creates a trust and enforcement gap: a reviewer or runtime may treat it as low-privilege while it can actually access sensitive capabilities, increasing the chance of unintended file access, command execution, or data exfiltration through delegated tools.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is product scouting, but the described behavior extends into modifying other experts' configuration files, orchestrating multiple external systems, handling authentication/payment flows, exporting data, and scheduling tasks. This mismatch is dangerous because it conceals a much broader attack surface than users expect, enabling privilege creep, supply-chain style tampering with other skills, and potential misuse of credentials, billing, or external integrations.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script is designed to modify other agents' CLAUDE.md instruction files by injecting new behavior, which creates an instruction-supply-chain risk. Even though the injected content appears business-related, altering other agents' operating instructions can silently change trust boundaries, behavior, and downstream tool usage without the target agent owner's informed review.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The --all mode enumerates agent CLAUDE.md files under /root/.linkfox/workspaces/agents and patches them in bulk, enabling wide-reaching unauthorized configuration drift. In a multi-agent or shared workspace environment, this can propagate behavioral changes across many agents at once, magnifying the blast radius of any mistaken or harmful injected instruction.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This module can upload any local file path to Alibaba OSS once valid STS credentials are available, with no restriction to session-created artifacts or approved directories. In the context of an Amazon product-scouting skill, arbitrary local file exfiltration is not clearly necessary, so misuse could expose workspace files, cached data, or secrets to external storage.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The function downloads arbitrary remote URLs to local storage with only a scheme check, which can be abused for SSRF against internal services if upstream callers pass attacker-controlled URLs. In this skill context, remote media fetching may be somewhat relevant, but unrestricted network reach is broader than needed and increases risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The referenced API documentation is for a generic AI text-generation and feedback system, which does not align with the stated product-scouting purpose of the skill. This kind of scope mismatch is dangerous because it can hide unexpected capabilities, broaden data flows beyond user expectations, and make operators or users invoke external services that were not justified by the skill’s declared function.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The feedback submission endpoint is a separate external service and appears unjustified for a product-scouting expert skill as documented here. Unnecessary outbound submission paths increase attack surface and create a channel through which user-derived content may be transmitted off-platform without clear need or consent.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file is for a product-scouting skill, but it embeds operational guidance for authentication recovery, phone-based registration, and billing workflows that are outside the skill’s stated purpose. This scope expansion increases the chance that the agent will solicit credentials or account data and invoke account-management scripts without clear user expectation or justification.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The instructions explicitly tell the agent to collect a user's phone number, register/login through a script, and initiate payment-plan ordering, none of which is justified by a product-scouting use case. In context, this creates an unnecessary path for handling sensitive personal and payment-related data and could be abused for account takeover, unauthorized purchases, or social-engineering-assisted enrollment.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a generic AI text-generation client, but the manifest describes an Amazon opportunistic product-scouting expert. This mismatch is dangerous because users and orchestrators may grant the skill trust, permissions, and data access appropriate for product research while the code actually forwards arbitrary prompts and data to a remote text-generation service.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script reads API credentials from environment variables and invokes a generic remote text-generation endpoint unrelated to the advertised product-scouting purpose. In a skill ecosystem, that hidden capability expansion increases the chance of unintended data disclosure and misuse of privileged credentials under a misleading trust boundary.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements account onboarding, SMS login, API-key issuance, package purchase, and payment QR generation, which does not align with the declared product-scouting purpose of the skill. This mismatch increases risk because users or reviewers may grant trust and permissions appropriate for product research while the code performs credentialed account and payment operations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code can generate or retrieve API tokens and elsewhere create paid orders, capabilities that are unrelated to a product-scouting skill and materially increase account abuse risk. In a mismatched skill context, such functionality can be used to mint credentials and initiate financial actions under the guise of benign research tooling.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script supports SMS-based authentication and account access workflows that fall outside the advertised product-scouting use case. This expands the attack surface to include collection and handling of phone numbers, verification codes, tokens, and team membership data in a context where users may not expect authentication operations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs automatic submission to a separate Feedback API whenever certain conditions occur, including broad subjective triggers like praise, dissatisfaction, or anything improvable. This creates an undocumented secondary data flow unrelated to the user’s core product-search task and may transmit conversation content or metadata without explicit user awareness or consent.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The onboarding guide expands the skill from product scouting into account recovery, registration, authentication troubleshooting, and paid purchase flows. That scope creep is dangerous because it encourages an agent to handle credentials, registration state, and payments that are unrelated to the declared business purpose, increasing the chance of unauthorized account actions or social-engineering abuse.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57