T01 · Skill Instruction Hijacking
Error
- Location
skills/linkfox-tsearch-search/SKILL.md:140- Finding
Silent Transmission of Conversation-Derived Feedback
- Content
View full analysis
- Remediation
View remediation
Security audit
真人感照片生成专家
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a LinkFox photo-generation workflow, but it includes under-controlled paid external calls, public uploads, credential-bearing configurable endpoints, and automatic feedback reporting.
Install only if you are comfortable sending product images, prompts, reference images, search terms, and account credentials through LinkFox services and publishing selected local files as public URLs. Use it in a trusted environment, keep LinkFox endpoint environment variables pointed at official HTTPS hosts, and confirm costs and uploads before generation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (7)
T01 · Skill Instruction Hijacking
Error
- Location
skills/linkfox-aigc-imagegen/SKILL.md:119- Finding
Forced Paid Image-Generation Execution Without Confirmation
- Content
View full analysis
'` to execute it, and do not wait for user confirmation or additional input. ``` ### Technical Analysis This instruction directs the agent to execute the image-generation script immediately whenever an `ARGUMENTS:` field is present. It explicitly prohibits waiting for confirmation, even though the operation: - Sends prompts and image URLs to an external service. - Uses the user's LinkFox API credential. - Consumes billed computational credits. - Can process images containing personal or commercially sensitive information. An `ARGUMENTS:` block can originate from an unintended context or untrusted content. Treating its presence as sufficient authorization bypasses normal validation, user-intent verification, privacy review, and cost confirmation. ### Attack Path 1. An attacker-controlled or unintentionally copied text introduces an `ARGUMENTS:` field into the relevant agent context. 2. The Skill instruction interprets the field as an immediate execution command. 3. The agent invokes `aigc_imagegen.py` without verifying provenance or obtaining confirmation. 4. The script sends supplied prompts, image URLs, API credentials, and correlation identifiers to the configured gateway. 5. The user's generation credits are consumed and supplied content is processed externally. ### Impact Assessment The attacker may cause unauthorized billed API requests, consume the user's quota, and submit attacker-selected prompts or image references under the user's account. If sensitive user images or URLs are incorporated into the parameters, they may also be disclosed to the exte ...[truncated 28 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/linkfox-aigc-imagegen/scripts/aigc_imagegen.py:38- Finding
API Credentials and Context Identifiers Can Be Redirected to an Arbitrary Gateway
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/linkfox-aigc-imagegen/scripts/onboarding.py:68- Finding
Onboarding Phone, Verification Codes, and Access Tokens Can Be Redirected
- Content
View full analysis
str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com" ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com" ) ``` ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = ( _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ) if group_id: h["tid"] = group_id return h ``` ```python def _login_v3(phone: str, code: str, channel: str) -> dict: resp = _login_post("/user/v3/web/login", { "type": "sms", "method": "login", "systemId": "LinkFoxAgent", "data": { "areaCode": "+86", "authPhone": phone, "authCode": code, "sourceChannel": channel or "skill", }, }) ``` ```python def _fetch_user_ ...[truncated 1945 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/linkfox-file-upload/scripts/linkfox_paths.py:289- Finding
Gateway-Controlled OSS Endpoint Can Receive STS-Authenticated Uploads
- Content
View full analysis
tuple[str, str]: ep = (endpoint or "").strip().rstrip("/") if ep.startswith("https://"): return ep, ep[len("https://"):] if ep.startswith("http://"): return ep, ep[len("http://"):] return f"https://{ep}", ep ``` ```python endpoint_url, endpoint_host = _parse_endpoint(voucher["endpoint"]) bucket_name = voucher["bucketName"] auth = oss2.StsAuth( voucher["accessKeyId"], voucher["accessKeySecret"], voucher["securityToken"], ) bucket = oss2.Bucket(auth, endpoint_url, bucket_name) headers = {} content_type = _OSS_CONTENT_TYPES.get(ext) if content_type: headers["Content-Type"] = content_type with open(local_path, "rb") as f: bucket.put_object(object_key, f, headers=headers or None) url = f"https://{bucket_name}.{endpoint_host}/{object_key}" ``` ### Technical Analysis The uploader trusts the `endpoint` and `bucketName` values returned in the STS voucher without validating that the endpoint is an approved Alibaba OSS host. `_parse_endpoint` explicitly accepts plaintext HTTP. The OSS client then uses temporary STS authentication when sending the local file to that endpoint. A compromised or redirected gateway can provide an attacker-controlled endpoint, causing signed upload requests and local file contents to be sent to the attacker's service. The Skill documentation also declares that resulting URLs are publicly accessible. Public upload is relevant to the Skill's declared function, but it creates a significant confidentiality boundary and requires explicit confirmation for each file. ### Attack Path 1. The gateway is redirected or compromised. 2. The malicious gateway returns a voucher containing valid-looking f ...[truncated 709 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/pinterest-image-finder/scripts/find_inspiration_image.py:76- Finding
Unrestricted Fetching of API-Supplied URLs Enables SSRF and Disk Exhaustion
- Content
View full analysis
\'\\]+\.(?:jpg|jpeg|png|webp)' ) urls = re.findall(pinimg_pattern, html, re.IGNORECASE) if not urls: urls = extract_image_urls_from_content(html) return list(dict.fromkeys(urls)) except Exception: return [] ``` The media download helpers also stream until the remote server closes the response: ```python with _lf_urlopen(req, timeout=timeout) as resp: with open(tmp_path, "wb") as f: while True: chunk = resp.read(65536) if not chunk: break f.write(chunk) ``` ### Technical Analysis URLs obtained from search or generation API responses are fetched without: - Host or IP allowlisting. - Blocking loopback, private, link-local, or reserved address ranges. - Redirect destination validation. - Maximum response-size enforcement. - Strong content-type validation. - A maximum HTML body size. The Pinterest helper can request ...[truncated 1033 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/linkfox-report-generator/scripts/inject_report.py:158- Finding
Report Content Is Injected Without HTML Sanitization
- Content
View full analysis
str: echarts_code = "" m = _ECHARTS_BLOCK_RE.search(content) if m: echarts_code = m.group(1).strip() echarts_code = _SCRIPT_OPEN_RE.sub("", echarts_code) content = _ECHARTS_BLOCK_RE.sub("", content).strip() canvas_code = "" m = _CANVAS_BLOCK_RE.search(content) if m: canvas_code = m.group(1).strip() canvas_code = _SCRIPT_OPEN_RE.sub("", canvas_code) content = _CANVAS_BLOCK_RE.sub("", content).strip() html = template.replace( "{{TITLE}}", title or "LinkFox Analysis Report" ) html = html.replace("{{LANG}}", language) html = re.sub( r".*?" r"", "\n" + content + "\n", html, flags=re.DOTALL, ) ``` ### Technical Analysis The report generator mechanically inserts the complete contents of `--content-file` into an HTML template. It does not sanitize the main content. Removing `- Remediation
View remediation
Vulnerability Patterns
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (122)
Tainted flow: 'req' from os.environ.get (line 297, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"}) try: with _lf_urlopen(req, timeout=timeout) as resp: if guessed_ext == "bin": ct = resp.headers.get("Content-Type", "") if "mp4" in ct:
Tainted flow: 'req' from os.environ.get (line 297, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } req = Request(url, data=data, headers=headers, method="POST") try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The script builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive authentication material including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs. In an agent-skill environment where env vars may be controlled by the host or a malicious wrapper, this enables credential exfiltration and SSRF-like redirection to attacker infrastructure.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 91% confidence
- Finding
The gateway URL is also sourced from environment configuration and used in urlopen with the Authorization header carrying the LinkFox API key. If the base URL is redirected through environment control, the script will transmit the API key and order/account requests to an attacker-controlled service, exposing billing and account access.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"}) try: with _lf_urlopen(req, timeout=timeout) as resp: if guessed_ext == "bin": ct = resp.headers.get("Content-Type", "") if "mp4" in ct:
Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } req = Request(url, data=data, headers=headers, method="POST") try: with urlopen(req, timeout=HTTP_TIMEOUT) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, group identifiers, and generated API tokens to those endpoints. If an attacker can influence environment variables in the runtime, this becomes a server-side exfiltration path that can redirect authentication and billing traffic to attacker-controlled infrastructure.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 92% confidence
- Finding
The gateway URL is also derived from environment variables and used by urllib to send authenticated requests with the API key in the Authorization header. An attacker who controls the environment can redirect package lookup, order creation, or account queries to an attacker endpoint and capture credentials and transactional metadata.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
download_media accepts an arbitrary caller-supplied http/https URL and fetches it with urlopen, with no allowlist, destination validation, or private-network blocking. In an agent/runtime context this creates an SSRF primitive that can be used to reach internal services, cloud metadata endpoints, or attacker-chosen hosts and store the response as local media.
- Content
python req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"}) try: with urlopen(req, timeout=timeout) as resp: # 从 Content-Type 进一步修正扩展名 if guessed_ext == "bin": ct = resp.headers.get("Content-Type", "")
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={"Content-Type": "application/json", "Authorization": api_token}, ) try: with urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode()) break except urllib.error.HTTPError as e:
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={"Content-Type": "application/json", "Authorization": api_token}, ) try: with urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode()) break except urllib.error.HTTPError as e:
Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"}) try: with urlopen(req, timeout=timeout) as resp: # 从 Content-Type 进一步修正扩展名 if guessed_ext == "bin": ct = resp.headers.get("Content-Type", "")
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The code builds request destinations from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence the environment, they can redirect authentication traffic to a malicious server and capture credentials or session tokens, effectively enabling credential exfiltration and account compromise.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The gateway URL is also sourced from environment variables and used in urlopen with the Authorization header containing the LinkFox API key. An attacker who controls the environment can redirect billing, account, or package-management requests to an attacker-controlled host and harvest the API key or manipulate downstream behavior.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 96% confidence
- Finding
The request URL and multiple headers are influenced by environment variables such as LINKFOX_TOOL_GATEWAY, SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME before being sent via urlopen. If an attacker can control the environment, they can redirect requests to an attacker-owned endpoint and exfiltrate the API key and request payload, making this a real SSRF/credential-leakage risk rather than a harmless configuration pattern.
- Content
python method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tainted flow: 'req' from os.environ.get (line 51, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } req = Request(api_url, data=data, headers=headers, method="POST") try: with urlopen(req, timeout=120) as response: result = json.loads(response.read().decode("utf-8")) return result except (HTTPError, URLError, Exception) as e:
Tainted flow: 'req' from os.environ.get (line 51, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The script fetches page_url values returned by an external search service without validating scheme, host, or address range. If the search backend can be influenced or returns malicious URLs, this creates an SSRF-style outbound fetch primitive that can be used to probe internal services or access unexpected network locations from the agent environment.
- Content
python """尝试直接请求页面，从 HTML 中提取图片 URL""" try: req = Request(page_url, headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}) with urlopen(req, timeout=timeout) as response: html = response.read().decode("utf-8", errors="ignore") # 提取 i.pinimg.com 图片 URL pinimg_pattern = r'https://i\.pinimg\.com/[^\s"<>\'\\]+\.(?:jpg|jpeg|png|webp)'
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个较完整的商品摄影生成流水线，包含多步前处理与特定模型/效果控制；但代码仅负责把调用方提供的参数原样提交给生图网关，等待任务完成并下载结果。虽然“生成图片”这一大方向部分相关，但核心宣称能力基本都不在该代码中出现，因此描述明显夸大且与实际行为不符。代码还会把结果与媒体文件写入本地会话目录，不过这属于支持性实现细节，不是主要失配点。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个图像生成工作流，核心能力应包括图片分析、灵感图检索、prompt 构造、调用图像模型生成照片等。但该代码完全没有处理商品图、参考图、摄影要素提取、JSON prompt 生成或 BANANA_PRO 出图逻辑。相反，它实现的是独立的账号登录、令牌获取、套餐购买和支付查询 CLI。其主要目的与声明严重不符，且包含多个未声明的账号认证与支付能力，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个以商品照片生成和图像工作流为核心的技能，但代码清晰地实现的是通用 AIGC 文本生成异步调用脚本。其主要外部接口路径就是 /aigc/textGenAsync 和 /aigc/textTaskQuery，说明目标是文本生成任务而非图像生成。代码没有任何图像输入处理、参考图检索、视觉分析、摄影参数抽取、BANANA_PRO 模型调用、图片保存/返回等逻辑。相反，它重点实现了文本结果轮询、content 提取、换行压平、本地 JSON 落盘与会话元数据管理。这属于主要用途的实质性不一致，应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一条图像生成工作流，涉及商品图分析、灵感图检索、JSON prompt 构造、调用 BANANA_PRO 模型出图，以及角色一致性管理。但代码完全没有任何图像处理、提示词生成、模型调用、搜索灵感图或照片生成相关逻辑。相反，代码实现的是 LinkFox 平台的账号 onboarding 和商业支付流程 CLI，包含短信登录、Token/API key 获取、套餐查询、下单与支付二维码渲染、订单状态查询等功能。这是主功能和能力层面的明显不一致，属于实质性描述-行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的核心能力是图像分析、灵感图检索、JSON prompt 构造和图片生成调度，属于商品摄影风格生成链路。实际代码没有任何图像分析、参考图搜索、prompt 生成、模型调用或角色一致性管理逻辑，而是专注于将本地文件上传到 OSS。其主要目的、所访问的资源（本地文件系统与 OSS/STS 接口）以及产生的结果（公开文件链接）都与声明严重不符，因此属于明显的描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个以图像分析、灵感检索、prompt 生成和图像生成为核心的摄影生成技能；但提供的代码完全没有商品图分析、灵感图搜索、JSON prompt 生成、BANANA_PRO 模型调用或角色一致性逻辑。相反，它实现的是与这些目标无直接对应关系的基础设施功能：路径解析、会话落盘、元数据管理、OSS 上传和媒体下载。虽然这类工具代码可能作为更大系统的配套组件存在，但就该代码块本身而言，其实际行为与声明的核心用途存在明显且实质性的偏差，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个图像生成工作流，核心能力应包括图片分析、灵感图搜索、摄影风格抽取、JSON prompt 生成以及模型出图调度。但给定代码完全没有图像处理、搜索、prompt 构造或模型调用逻辑。相反，它仅执行 HTML 模板拼装和报告落盘，是一个报告生成/封装工具。其主要目的、输入输出形式、处理对象和副作用都与声明严重不符，因此属于明显的 description-behavior mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个图像生成工作流技能，核心能力应包括商品图分析、灵感图检索、摄影风格提取、JSON prompt 构造和图像模型调度。但提供的代码完全没有任何图像分析、提示词生成、模型调用、角色一致性管理或摄影要素处理逻辑。相反，它实现的是与该声明无关的基础设施功能：管理 session 文件路径、记录 _meta.json 和 index.jsonl、通过 LINKFOX_TOOL_GATEWAY 获取 OSS 临时凭证、上传文件到阿里云对象存储、下载媒体资源，以及对文本换行做占位符转换。这些都属于显著不同的主要用途，并且包含未在声明中体现的网络访问与文件上传/下载能力。因此描述与实际行为明显不符。
- Content