销量飙升榜专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:07 AM UTC
• Version: 1.0.1

Overview

The skill can perform the advertised Amazon product scouting, but it also includes broader account, scheduling, public-upload, generic script execution, and agent-instruction modification capabilities that are not tightly scoped to scouting.

Review before installing. This is not just a product-scouting helper: it can use LinkFox credentials, store product data locally, create scheduled agent tasks, upload files to public URLs, guide account/payment flows, and includes code that can patch other agents' CLAUDE.md files. Install only if you trust the publisher and want those broader capabilities; avoid using the instruction-patching and skill-modification paths unless you intentionally need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 95% confidence
• Finding: The code executes another Python script via subprocess using a script path that can be overridden by the SELLERSPRITE_SCRIPT environment variable. Although subprocess.run is invoked without shell=True, this still permits execution of attacker-chosen local code if the environment is influenced, which is dangerous in an agent/skill context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

timed_out = False
    try:
        proc = subprocess.run(
            [sys.executable, str(main_script), params_str],
            capture_output=True,
            text=True,

• Confidence: 90% confidence
• Finding: The code invokes a Python subprocess on a user-supplied --script path, which creates a direct arbitrary local code execution primitive. Although subprocess.run is used without shell=True, the danger is not shell injection but that the helper will execute any local Python file the caller points at, which is far broader than the skill’s stated product-scouting purpose.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

• Confidence: 93% confidence
• Finding: `get_sts_voucher()` reads `LINKFOX_TOOL_GATEWAY` and `LINKFOX_AGENT_API_KEY` from the environment and sends an authenticated request to whatever base URL the environment supplies. If an attacker can influence the environment, they can redirect the request to an attacker-controlled server and capture the bearer token, enabling credential exfiltration and abuse of downstream APIs.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 81% confidence
• Finding: The subprocess working directory is derived from ACPX_WORKSPACES in the environment, so execution context is partially controlled by external state. This can change which files, modules, or relative paths are loaded by the child script and can enable unintended code or data influence if the runtime environment is attacker-controlled.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 41, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 98% confidence
• Finding: SKILL_SCRIPT is sourced from SELLERSPRITE_SCRIPT and passed directly to the Python interpreter in subprocess.run. If an attacker can set that environment variable, they can cause arbitrary local Python code execution under the privileges of this agent.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST target URL is derived from environment-configurable base URLs and then used to send login, token, and user-account data via requests.post. If an attacker can influence environment variables, the script can be redirected to an attacker-controlled endpoint and exfiltrate SMS codes, access tokens, refresh tokens, API keys, or account metadata.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request path uses a URL built from environment-controlled base configuration and sends the bearer API key in the Authorization header through urllib.request.urlopen. An attacker who can set the environment can redirect authenticated gateway traffic and capture the API key or manipulate billing and account operations.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, bearer tokens, and generated API keys, to those endpoints. If an attacker can influence environment variables in the host or workspace, they can redirect these requests to attacker-controlled infrastructure and capture credentials or payment-related data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: Gateway requests use a URL derived from environment variables and attach the API key in the Authorization header before calling urlopen. This creates a direct exfiltration path for secrets if the environment is poisoned, especially because the same flow also reaches account, package, and order endpoints.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in headers and uses a gateway base URL that can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. In an agent environment, this enables credential and metadata exfiltration to an attacker-controlled endpoint if the environment is influenced, because the Authorization API key and session identifiers are transmitted off-host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises and orchestrates shell execution, filesystem access, network/MCP use, and file output, but the metadata shown here does not declare permissions. That mismatch weakens reviewability and consent boundaries: a caller may invoke a seemingly simple scouting skill that actually has broad operational capability, including local file writes and external service calls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a substantial scope mismatch: the declared purpose is product scouting, but the documented behavior includes modifying other skills, JSON/state persistence, scheduling, external uploads, HTML/AIGC generation, and even onboarding/payment operations. Such hidden or under-declared capabilities create a confused-deputy risk where users or downstream systems grant trust for a narrow business task while the skill can perform unrelated high-impact actions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Allowing this scouting skill to invoke `expert-skill-creator` to add or modify skills is a powerful meta-programming capability unrelated to its stated function. In context, that means a data-retrieval workflow could become a persistence or policy-modification vector, expanding from product search into changing other agents' behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script can modify agent and workspace CLAUDE.md instruction files, which is outside the stated product-scout skill purpose and changes other agents' behavior persistently. This creates a supply-chain-style instruction tampering risk: a user invoking this helper can silently alter prompts, capabilities, and downstream execution patterns across agents.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Bulk patching of other agents' instruction files is a high-risk capability because it enables mass modification of trusted control documents under /root/.linkfox/workspaces/agents. In the context of an Amazon product-scout skill, this capability is unjustified and especially dangerous because it can propagate behavioral changes across many agents at once, effectively acting as a prompt/instruction injector.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: `download_media()` provides arbitrary remote retrieval over HTTP/HTTPS with no hostname allowlist or private-network protections. In an agent context, this can become an SSRF primitive or a way to fetch untrusted large/binary content unrelated to the skill’s stated purpose, increasing attack surface beyond the narrow Excel-delivery use case.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This runtime helper is intentionally generic and can execute arbitrary skill scripts while persisting whatever they print, making it a reusable execution-and-exfiltration component rather than a narrowly scoped sales-surge tool. That scope expansion increases attack surface because an agent or downstream component can repurpose it to run unrelated code and capture its output to disk.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The helper resolves any caller-provided local file path as the script to execute and only checks that it exists, enabling arbitrary local Python execution. In the context of a narrowly scoped Amazon product scouting skill, that capability is unjustified and materially increases the chance of misuse to run unrelated or sensitive local scripts.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as a text-generation capability, but the documentation instructs the agent to automatically chain its output into image/video generation workflows without additional user confirmation. This expands the effective privilege and execution scope of the skill, increasing the chance of unintended downstream actions, prompt/parameter propagation, and misuse of generated content in other tools.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation is internally contradictory: it declares the skill unsuitable for image/video generation while also requiring automatic chaining into image/video generation skills. Such inconsistency can cause agents to bypass safety expectations or invoke capabilities the user did not clearly request, making control boundaries ambiguous.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The referenced API documentation is for an unrelated AI text-generation and feedback service, while the skill metadata describes an Amazon sales-surge product scouting capability. This mismatch is dangerous because it can cause the agent to send user inputs, media URLs, and identifiers to a different external service than expected, creating a capability-confusion and unintended data exfiltration risk.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file contains authentication recovery, account registration, API key setup, and billing/payment workflows that are unrelated to the stated purpose of an Amazon product-selection skill. This kind of scope drift is dangerous because it normalizes requesting credentials, phone numbers, and payment actions inside a skill that should only analyze products, increasing phishing, abuse, and unauthorized account-manipulation risk.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The documentation instructs the operator to collect a user's phone number, trigger SMS-based registration/login, and initiate payment orders, none of which are justified by the advertised sales-scout use case. In context, these steps create a strong social-engineering surface where a user may be induced to share personal data or perform financial actions under the guise of routine skill operation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is an AI text-generation client, while the declared skill is an Amazon sales-surge product-scouting expert. This mismatch is dangerous because operators may grant the skill permissions, trust, and execution context intended for product scouting, while the code actually performs unrelated networked content-generation behavior. In a security review, capability/manifest drift is a strong indicator of repackaging, misdeployment, or deceptive bundling.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The main execution path creates async text-generation tasks, polls for results, transforms returned content, and optionally writes outputs to disk—behavior outside the manifest's Excel-focused product-scouting scope. Even if not overtly malicious, this hidden general-purpose generation capability broadens what the skill can do and makes policy, audit, and least-privilege enforcement less reliable.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57