精品铺货专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.2

Overview

The skill has a coherent product-scouting purpose, but it bundles and instructs broader automation that can persist tasks, rewrite agent instruction files, upload local files publicly, and send user-derived feedback externally.

Install only after reviewing the broader LinkFox automation permissions. Use it with a dedicated, low-privilege API key, do not set API endpoint override environment variables unless you trust the exact host, confirm any scheduled task cadence and cost before creation, avoid uploading sensitive local files, and do not run the CLAUDE.md patching script unless you intentionally want persistent agent-instruction changes and have backups.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T02 · Agent Memory Poisoning

Error

• Location: skills/amazon-asin-dynamic-scoring/scripts/patch_scoring_to_agent.py:142

Finding

Persistent Cross-Agent Instruction Injection

Content

View full analysis

bool: path = Path(filepath) if not path.exists(): print(f"ERROR: File not found: {filepath}") return False content = path.read_text(encoding="utf-8") if "二次评分（动态评分引擎）" in content: print(f"SKIP: {filepath} already has scoring step") return False if "amazon-product-scout-agent" not in content: print(f"SKIP: {filepath} does not use amazon-product-scout-agent") return False original = content changes = [] pattern_ref = r"(主脚本：call skill `amazon-product-scout-agent`[^\n]*)" if re.search(pattern_ref, content) and SKILL_REF_LINE not in content: content = re.sub( pattern_ref, r"\1\n" + SKILL_REF_LINE, content ) path.write_text(content, encoding="utf-8") print(f"PATCHED: {filepath}") return True ``` ```python if sys.argv[1] == "--all": agents_dir = Path("/root/.linkfox/workspaces/agents") targets = sorted(agents_dir.glob("*/CLAUDE.md")) root_claude = Path("/root/.linkfox/workspaces/CLAUDE.md") if root_claude.exists(): targets.append(root_claude) else: targets = [Path(p) for p in sys.argv[1:]] for t in targets: if patch_file(str(t)): patched += 1 else: skipped += 1 ``` ### Technical Analysis The bundled script discovers persistent `CLAUDE.md` instruction files and rewrites them with additional skill references, trigger phrases, workflow steps, interaction rules, and output requirements. The `--all` mode targets every matching agent under `/root/.linkfox/workspaces/agents` and the workspace-level instruction file. This behavior is not necessary to calculate produ ...[truncated 1281 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: skills/linkfox-sellersprite-product-search/SKILL.md:293

Finding

Automatic External Disclosure of User Statements and Intent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-sellersprite-product-search/scripts/sellersprite_product_search.py:36

Finding

Credential and Authentication Data Redirection Through Unvalidated Endpoint Overrides

Content

View full analysis

str: return ( os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com" ).rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding implementation similarly supports environment-selected endpoints: ```python def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com" ) ``` These endpoints receive phone numbers, verification codes, access tokens, and refresh tokens during onboarding. ### Technical Analysis The scripts attach API credentials and session identifiers to requests sent to a base URL inherited from envir ...[truncated 1448 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skills/linkfox-file-upload/scripts/file_upload.py:34

Finding

Unrestricted Publication of Arbitrary Readable Local Files

Content

View full analysis

[ ...]", file=sys.stderr ) sys.exit(1) lp = _paths() results = [] voucher = None had_error = False for path in args: if not os.path.isfile(path): results.append({ "error": True, "input": path, "message": "file does not exist" }) had_error = True continue try: if voucher is None: voucher = lp.get_sts_voucher() res = lp.upload_file(path, voucher=voucher) res["localPath"] = os.path.abspath(path) results.append(res) except Exception as e: voucher = None results.append({ "error": True, "input": path, "message": str(e) }) had_error = True ``` ```python file_size = os.path.getsize(local_path) max_size = voucher.get("maxFileSize") if isinstance(max_size, int) and max_size > 0 and file_size > max_size: raise RuntimeError("file exceeds the OSS size limit") supported = voucher.get("supportedTypes") if isinstance(supported, str) and supported.strip(): allowed = { t.strip().lower() for t in supported.split(",") if t.strip() } if allowed and ext not in allowed: raise RuntimeError("file type is not allowed") with open(local_path, "rb") as f: bucket.put_object(object_key, f, headers=headers or None) url = f"https://{bucket_name}.{endpoint_host}/{object_key}" ``` ### Technical Analy ...[truncated 1283 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skills/amazon-product-scout-agent/scripts/response_io.py:66

Finding

Arbitrary Local Python Execution Through Unrestricted Script Selection

Content

View full analysis

Path: p = Path(script_arg).expanduser() if not p.is_absolute(): p = (Path.cwd() / p).resolve() else: p = p.resolve() if not p.is_file(): _err(f"--script path not found: {p}") return p ``` ```python def cmd_run(args: argparse.Namespace) -> int: main_script = _resolve_script(args.script) skill_name = _resolve_skill_name(main_script) params_str = _resolve_params(args) child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" proc = subprocess.run( [sys.executable, str(main_script), params_str], capture_output=True, text=True, encoding="utf-8", errors="replace", env=child_env, timeout=args.timeout, ) ``` The scout agent also allows environment-controlled script replacement: ```python SKILL_SCRIPT = os.environ.get( "SELLERSPRITE_SCRIPT", os.path.join( _SKILLS_DIR, "linkfox-sellersprite-product-search", "scripts", "sellersprite_product_search.py" ) ) ``` ```python result = subprocess.run( [sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get( "ACPX_WORKSPACES", os.getcwd() ).split(os.pathsep)[0] ) ``` ### Technical Analysis The generic response wrapper accepts any existing filesystem path as `--script` and executes it with the current Python interpreter. It does not constrain the path to the package's scripts directory or an allowlist of approved entry points. The child receives a copy of the com ...[truncated 1327 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-report-generator/scripts/inject_report.py:123

Finding

Active Content Injection in Generated HTML Reports

Content

View full analysis

str: if not os.path.isfile(path): _die(f"--content-file path does not exist: {path}", 1) with open(path, "r", encoding="utf-8") as f: text = f.read() m = _OUTER_FENCE_RE.match(text) if m: text = m.group(1) text = text.strip() if not text: _die("--content-file is empty", 3) return text ``` ```python m = _ECHARTS_BLOCK_RE.search(content) if m: echarts_code = m.group(1).strip() echarts_code = _SCRIPT_OPEN_RE.sub("", echarts_code) content = _ECHARTS_BLOCK_RE.sub("", content).strip() html = re.sub( r".*?", "\n" + content + "\n", html, flags=re.DOTALL, ) if echarts_code: html = html.replace( "// ECHARTS_INIT_START\n // ECHARTS_INIT_END", "// ECHARTS_INIT_START\n " + echarts_code + "\n // ECHARTS_INIT_END", ) if canvas_code: html = html.replace( "// CANVAS_INIT_START\n // CANVAS_INIT_END", "// CANVAS_INIT_START\n " + canvas_code + "\n // CANVAS_INIT_END", ) ``` ### Technical Analysis The generator reads an HTML fragment and inserts it directly into the final document without escaping or sanitization. It also extracts chart and canvas blocks and inserts their contents into JavaScript execution contexts. Removing literal opening and closing `script` tags from the special blocks is not a security boundary. Ordinary content can still contain script elements, event-handler attributes, dangerous URL schemes, iframes, executable SVG, or other active HTML. Code inserted inside the chart markers executes as Jav ...[truncated 1011 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (151)

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/amazon-product-scout-agent/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The script sends sensitive runtime metadata and an API key-derived authenticated request to a gateway URL that can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable, requests including Authorization, SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME headers can be redirected to an attacker-controlled endpoint, causing credential and metadata exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code constructs request destinations from environment-controlled base URLs and then sends sensitive onboarding data, including phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens, via requests.post. In a skill context, environment variables are a weak trust boundary; if an attacker or misconfigured wrapper changes these endpoints, the script can exfiltrate credentials to an arbitrary host.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway URL is derived from environment variables and used by urllib.request.urlopen with the Authorization header containing the LinkFox API key. If that base URL is redirected to attacker infrastructure, the skill will transmit API credentials and order/account requests externally, enabling credential theft and unauthorized account operations.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

download_media() accepts an arbitrary caller-supplied URL and fetches it with urlopen after only checking for http:// or https://. That enables server-side request forgery to internal services, metadata endpoints, or attacker-controlled hosts, and the downloaded content is then written into session storage. In the context of an Amazon listing-scout skill, unrestricted outbound fetching is not necessary and increases risk.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

download_media() accepts an arbitrary URL and fetches it with urlopen after only checking for http/https. That enables SSRF-style access to internal services, cloud metadata endpoints, or attacker-controlled hosts, and the downloaded content is then written into the shared session area. In the context of a product-listing skill, unrestricted outbound fetching is broader than necessary and increases risk.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The POST target is derived from environment-controlled base URLs and is used to send highly sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables in the agent runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or payment-related data.

Content

Scanner excerpt · skills/linkfox-sellersprite-product-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway URL is built from environment-controlled configuration and then requested with an Authorization header carrying the API key. An attacker who can set the base URL can cause the tool to send the bearer credential and billing/order traffic to a malicious server, resulting in credential theft and abuse of the linked account.

Content

Scanner excerpt · skills/linkfox-sellersprite-product-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request sent via urlopen includes environment-derived values in both the destination base URL and headers, especially LINKFOX_TOOL_GATEWAY and session metadata fields. This allows an attacker who can influence the execution environment to redirect requests to an arbitrary host and exfiltrate API keys and contextual identifiers, which is a real SSRF/credential-leak risk rather than a benign configuration pattern.

Content

Scanner excerpt · skills/linkfox-sellersprite-product-search/scripts/sellersprite_product_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/amazon-product-scout-agent/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The download_media function performs outbound requests to arbitrary caller-supplied URLs and writes the response to disk with only a scheme check. This creates an SSRF-style primitive that can be used to reach internal services, fetch attacker-controlled content, or abuse the agent as a network proxy, which is not justified by the stated product-listing scouting purpose.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 249, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-task-scheduler/scripts/task_scheduler.py (reported line 264)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly expands into creating, updating, deleting, and listing scheduled tasks through another skill, which is broader than simple product scouting and Excel export. This matters because scheduling introduces persistence and repeated automated execution, so a user invoking a benign-looking scouting skill could unknowingly authorize ongoing networked actions and recurring cost consumption.

Content

No source excerpt is available for this finding.