潜力市场专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:06 AM UTC
• Version: 1.0.1

Overview

The core market-scouting workflow is understandable, but the package also exposes broader account, payment, upload, AI-generation, scheduling, and agent-modification capabilities that are not clearly scoped to that purpose.

Review this package before installing if you only want Amazon market scouting. Use it only in a trusted environment with controlled LINKFOX_* variables, and avoid the onboarding/payment, public upload, AIGC, scheduler deletion, and CLAUDE.md patching utilities unless you explicitly intend to use those capabilities. Treat generated API keys, phone numbers, payment QR/order data, webhook URLs, raw result files, and uploaded-file URLs as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 94% confidence
• Finding: The script launches another Python file via subprocess, and the target path is indirectly configurable through the SELLERSPRITE_SCRIPT environment variable. While shell metacharacter injection is avoided by using an argument list, this still permits execution of an attacker-controlled local script if the environment is influenced, which is dangerous in an agent skill context.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

• Confidence: 95% confidence
• Finding: `get_sts_voucher()` builds a request to a base URL taken from `LINKFOX_TOOL_GATEWAY` and sends the `LINKFOX_AGENT_API_KEY` in the `Authorization` header. If an attacker can influence that environment variable, the code will transmit the API key to an arbitrary server, causing credential exfiltration and potentially unauthorized access to backend services or OSS vouchers.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 91% confidence
• Finding: The subprocess working directory is derived directly from the ACPX_WORKSPACES environment variable with no validation. If an attacker can influence that environment, they can alter resolution context for the child process and potentially affect imports, file access, or which resources the helper script consumes, increasing the chance of arbitrary code execution or data access.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 41, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 97% confidence
• Finding: SKILL_SCRIPT can be overridden by the SELLERSPRITE_SCRIPT environment variable and is then executed with the Python interpreter. This is a direct arbitrary code execution primitive for anyone able to control the environment, and agent skills commonly run in automation contexts where environment trust boundaries are weak.

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The script reads API credentials and session metadata from environment variables and automatically transmits them in HTTP headers to a remote gateway. In a skill whose declared purpose is unrelated market scouting, silently sending credentials and contextual identifiers off-host increases the risk of secret exposure and unauthorized external communication, especially if the gateway base URL can be overridden by environment configuration.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code allows request destinations to be derived from environment-controlled base URLs and then sends sensitive data such as SMS login details, access tokens, refresh tokens, and API-token requests to those endpoints. In an agent/runtime environment where env vars may be influenced by a host, wrapper, or attacker, this enables credential exfiltration to arbitrary servers.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request uses a URL built from environment-controlled base configuration and includes the API key in the Authorization header before calling urlopen. If an attacker can alter the environment, they can redirect these authenticated requests to an attacker-controlled host and capture the API key or induce unintended actions.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used to send login data, access tokens, refresh tokens, group IDs, and token-generation requests. In a skill/onboarding context, allowing untrusted environment configuration to redirect these requests can exfiltrate sensitive credentials to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The gateway request URL is built from environment variables and used with the Authorization header containing the API key. If an attacker can influence the environment, requests can be redirected to an attacker-controlled server and the API key and related account actions exposed.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 97% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in headers, including the API key and session metadata, and the destination host is partly controlled by the LINKFOX_TOOL_GATEWAY environment variable. This creates a real exfiltration path: if that environment variable is poisoned, credentials and contextual metadata will be sent to an attacker-controlled endpoint over the network.

Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体

• Confidence: 91% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in HTTP headers, including the API key and session metadata, and the destination base URL is resolved dynamically through imported helper logic rather than being hardcoded in this file. If the resolved endpoint can be influenced or misconfigured, the script will transmit credentials and contextual identifiers to that remote host, creating a credential-exfiltration and data-leak risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill documents capabilities that imply shell, network, file read/write, environment access, and inter-skill/MCP orchestration, but no permissions are declared. This creates a dangerous transparency and policy gap: reviewers and runtime controls may underestimate what the skill can do, while the workflow includes filesystem output, external service calls, and script execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented behavior substantially exceeds the advertised purpose of 'potential market scouting' and includes cross-skill modification/creation, scoring over local data files, onboarding/payment-related flows, uploads, HTML generation, and multi-service gateway access. This mismatch prevents informed consent, defeats least privilege, and can be abused to perform sensitive actions the user did not reasonably authorize under the stated skill description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly allows adding or modifying capabilities by invoking a separate skill creator from within this scouting skill. That is a form of indirect prompt/code/skill injection surface expansion: a user entering a product-research workflow can be pivoted into changing agent behavior and expanding capabilities beyond the original trust boundary.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script's stated skill purpose is Amazon market scouting, yet it actually rewrites other agents' CLAUDE.md instruction files to inject new behavior. That is dangerous because it enables cross-agent persistence and unauthorized modification of trust boundaries, causing unrelated agents to silently change behavior and invoke additional skills without explicit user review.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The --all mode enumerates /root/.linkfox/workspaces/agents and bulk-rewrites every discovered CLAUDE.md, which expands the blast radius from a single file to the whole agent workspace. In the context of a scouting skill, this capability is unjustified and creates a high-risk mechanism for mass instruction tampering, persistent behavior changes, and supply-chain-style compromise of multiple agents at once.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file identifies itself as API documentation for a different skill (`linkfox-aigc-textgen`) than the audited market-scouting skill. This kind of identity and purpose mismatch is dangerous because it can cause an agent to invoke unrelated capabilities, expose the wrong data flows, or mask undeclared functionality behind misleading packaging.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The documented API behavior is asynchronous AI text generation and media analysis, not market scouting or product selection. A capability mismatch like this can result in the agent sending user prompts, images, videos, or member identifiers to an external generative service under false pretenses, creating undeclared functionality and data exposure risk.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documentation introduces a separate external feedback submission endpoint unrelated to the stated purpose of the skill. This creates an additional outbound data path that could transmit user statements or operational details to a third-party service without clear necessity, review, or consent in the skill's advertised behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The onboarding document adds authentication recovery, scripted registration, and billing/payment workflows that are outside the stated purpose of a market-scouting skill. This kind of scope expansion increases the attack surface by encouraging the agent to handle credentials, account lifecycle actions, and payment flows that should be isolated from the core skill.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The document instructs the agent to solicit a user's phone number and use a script to send codes and log in on the user's behalf, even though that is unrelated to market scouting. Collecting phone numbers and facilitating account registration/login through the skill creates unnecessary exposure of personal data and can enable account takeover or misuse if the flow is abused or poorly controlled.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill documentation includes plan listing, payment-method selection, order creation, and payment-status querying despite these functions being unrelated to product scouting. Embedding billing workflows in the skill can mislead users into authorizing financial actions through an agent path that may lack the safeguards, verification, and anti-fraud controls expected for payments.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements asynchronous AI text-generation task submission and polling, which does not match the advertised Amazon market-scouting/product-selection skill. This capability mismatch is dangerous because users and orchestrators may grant the skill broader trust or access under false assumptions, while the code actually sends arbitrary text-generation inputs to a remote service and writes outputs to disk.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code accesses API credentials for an AIGC gateway and uses them for remote requests even though the surrounding skill metadata describes a different business function. This unjustified credential use suggests over-privileged behavior and increases the chance that secrets are exposed to an external service users did not intend to authorize for this skill.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file implements account onboarding, SMS login, API-key provisioning, subscription listing, ordering, and payment QR generation, which is materially unrelated to the declared market-scouting skill purpose. Such hidden or unjustified capability expansion is dangerous because it collects credentials and initiates financial flows users would not expect from this skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57