ClawHub
Back to skill

Security audit

精品铺货专家

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly for Amazon product scouting, but it also bundles and documents broader account, payment, scheduling, upload, and agent-modification capabilities that deserve user review before installation.

Install only if you trust the LinkFox publisher and want this skill to have more than product-search access: it may use your LinkFox API key, help with account/payment onboarding, create persistent scheduled tasks, write local result files, upload files to public URLs, and includes tooling capable of modifying other agent instructions. Review endpoint environment variables and avoid running the patching or self-extension paths unless you explicitly intend those changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (50)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), params_str],
            capture_output=True,
            text=True,
Confidence
90% confidence
Finding
The wrapper executes a script path supplied via `--script`, making this helper a general-purpose code execution launcher. Although `subprocess.run` is invoked with an argument list rather than a shell string, the security issue is the broad execution capability itself: if an attacker can influence `--script`, they can run arbitrary local Python code with the agent's privileges.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:
Confidence
89% confidence
Finding
The code reads `LINKFOX_AGENT_API_KEY` from the environment and sends it in an `Authorization` header to a URL whose base is controlled by `LINKFOX_TOOL_GATEWAY`. If an attacker can influence that environment variable, they can redirect the request to an attacker-controlled host and exfiltrate the API token and receive back forged STS upload credentials.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High
Category
Data Flow
Content
call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None
Confidence
94% confidence
Finding
The working directory for the spawned process is taken directly from the ACPX_WORKSPACES environment variable without validation. An attacker who can influence that environment can redirect execution context to an attacker-controlled directory, which can affect imports, file resolution, and the behavior of the launched script, enabling arbitrary code execution through path hijacking.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 81, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None
Confidence
98% confidence
Finding
SKILL_SCRIPT can be overridden via the SELLERSPRITE_SCRIPT environment variable and is then executed with the Python interpreter. This creates a direct arbitrary code execution primitive for anyone able to set the environment, because the agent will run any attacker-chosen Python file instead of the intended helper script.

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
The request sends sensitive environment-derived values over the network, including the API key in `Authorization` and additional context headers (`SESSION_ID`, `MODE_ID`, `APP_NAME`). Because the destination base URL is also configurable through `LINKFOX_TOOL_GATEWAY`, a compromised or misconfigured environment can redirect these secrets to an attacker-controlled endpoint, causing credential exfiltration.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
92% confidence
Finding
The POST destination is derived from environment-controlled base URLs, and the request can carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables in the host or workspace, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
91% confidence
Finding
The gateway request target is built from environment-controlled values and is used with the bearer API key from environment variables in the Authorization header. A maliciously set base URL would cause authenticated requests, including account, package, and order operations, to be sent to an attacker-controlled endpoint.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
97% confidence
Finding
The POST destination is derived from base URLs read from environment variables and is used to transmit highly sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In a hostile or multi-tenant runtime, an attacker who can influence those environment variables can redirect authentication traffic to an attacker-controlled endpoint and exfiltrate credentials and session material.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
The gateway request target is also built from environment-controlled base URLs, while attaching the API key in the Authorization header. If the environment is tampered with, the CLI will send the user's API key and account/order operations to an attacker-selected server, enabling credential theft and fraudulent actions.

Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体
Confidence
94% confidence
Finding
The request sent via urlopen includes multiple headers populated directly from environment variables, and the destination base URL is resolved dynamically from shared path logic rather than being hardcoded in this file. If an attacker can influence the runtime environment or shared resolver, sensitive metadata and the API key can be transmitted to an unintended remote endpoint, creating an exfiltration path.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises and orchestrates shell execution, network access, file read/write, and MCP-style cross-tool interactions without any declared permissions. That removes an important trust boundary: users and reviewers are not informed that the skill can execute code, access local/stateful data, and invoke external services, which increases the chance of unintended privileged actions or data exposure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior substantially exceeds the declared purpose of Amazon product scouting and Excel export, including modifying other agents' configuration, payment/order flows, OSS uploads, HTML generation, scheduling, and asynchronous AIGC operations. This scope mismatch is dangerous because operators may grant trust and run the skill expecting narrow listing analysis, while it actually has pathways for cross-agent tampering, external data transfer, and account-linked transactions.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Allowing this scouting skill to invoke `expert-skill-creator` to add or change other skills creates an unnecessary self-extension and code/workflow generation capability unrelated to the advertised function. In context, this is especially risky because it can be used to bypass the original skill boundary, introduce new privileged behaviors, or mutate the surrounding agent ecosystem without the user expecting that level of authority.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The workflow expands from product selection into arbitrary workflow/skill generation, which materially exceeds the manifest's stated scope. Such uncontrolled functional expansion undermines policy enforcement and user consent, because a seemingly domain-specific scouting assistant can become a general-purpose orchestrator that changes behavior and capabilities at runtime.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script's behavior is to modify agent CLAUDE.md files, which is unrelated to the advertised Amazon scouting/scoring purpose and creates a hidden cross-agent modification capability. In a skill ecosystem, that is dangerous because it can silently alter other agents' instructions, behavior, or trust boundaries, effectively acting as a persistence or propagation mechanism.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The --all mode enumerates and bulk-modifies CLAUDE.md files under /root/.linkfox/workspaces/agents and the workspace root, giving this script broad write access across unrelated agents. That capability is especially risky in this context because it enables mass tampering of operational prompts/instructions, which could change downstream agent behavior at scale without users realizing it.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The docstring says the tool injects only into experts using amazon-product-scout-agent, but the implementation supports scanning all agents and the root CLAUDE.md, which understates the script's real reach. This mismatch is dangerous because it can mislead reviewers or operators about scope, making broad cross-agent modifications easier to hide or accidentally authorize.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
This shared helper includes remote credential retrieval and OSS upload capabilities that exceed a simple local path utility and are not clearly justified by the product-scouting skill description. The added networked upload path expands the attack surface and creates an easy route for unintended data exfiltration if other parts of the skill pass sensitive files into `upload_file`.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The module advertises use of environment-sourced API credentials and external upload infrastructure even though the skill is described as an Amazon product-scouting tool. In this context, hidden credential use and outbound transfer capability are more suspicious because they are not necessary for core local ranking/filtering logic and can facilitate unauthorized external communication.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Allowing an external script path to be supplied by environment variable is beyond normal product-scouting needs and effectively delegates code execution to ambient process state. In an agent environment, that is especially dangerous because the skill becomes a wrapper that can launch arbitrary local Python code under the agent's privileges.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This file is a generic runtime wrapper that can execute arbitrary scripts, which is broader than the declared Amazon product-scout purpose. In an agent setting, capability mismatch is dangerous because it enables repurposing the skill as a general executor rather than a narrowly scoped business tool, increasing the blast radius of prompt injection or argument manipulation.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file packaged for an Amazon listing scout skill documents APIs for a different skill (`linkfox-aigc-textgen`), including authentication details, request formats, and polling behavior for AI text generation. This creates a capability/context mismatch that can cause the agent to invoke unintended external services, send user data to an unrelated endpoint, or expand the effective privileges of the skill beyond its declared product-selection purpose.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The file exposes a separate public feedback submission endpoint unrelated to the stated Amazon product-selection workflow. In an agent setting, this can be misused to transmit user content or operational data to an external service outside the expected task scope, creating unauthorized data egress and an opportunity for spam or covert telemetry.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file documents authentication recovery, phone-based account registration, and billing workflows that are unrelated to the declared Amazon listing-scout purpose of the skill. This kind of scope expansion increases the attack surface and can enable collection of sensitive user data or off-purpose account/payment handling without clear justification, which is risky in an agent skill context.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The documented flow asks the agent to help users provide a phone number, send a verification code, log in, retrieve an API key, and guide plan purchases. For a product-listing scout skill, these capabilities are unjustified and dangerous because they facilitate credential handling, account creation, and payment enablement that could be abused for phishing, unauthorized account provisioning, or unauthorized purchases.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/linkfox-task-scheduler/references/api.md:57