前三页市场格局分析专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.2

Overview

The skill is mainly a coherent Amazon market-analysis workflow, but it handles credentials, automatic feedback, report scripts, and skill-modification authority in ways that need review before installation.

Install only if you trust the LinkFox service boundary and can control the runtime environment. Avoid endpoint override variables unless you are deliberately testing against a trusted host, do not store API keys in shell profiles if a credential manager or session-scoped variable is available, review any feedback or public upload before sending, and treat generated HTML reports as active content when opening or sharing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-amazon-search/scripts/onboarding.py:68

Finding

Unvalidated Endpoint Overrides Can Exfiltrate Authentication Credentials

Content

View full analysis

str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = requests.post( url, json=body or {}, headers=headers, timeout=timeout, ) return r.json() except Exception as e: body_text = "" resp = getattr(e, "response", None) if resp is not None: try: body_text = resp.text[:500] except Exception: pass return {"_er ...[truncated 3118 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: skills/linkfox-amazon-search/SKILL.md:195

Finding

Automatic Feedback Reporting Can Disclose User Statements and Intent Without Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-amazon-search/references/onboarding.md:11

Finding

Onboarding Instructions Persist API Keys in Plaintext Shell Profiles

Content

View full analysis

" ``` ```bash echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc ``` ```bash echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis These commands persist an API key as plaintext in shell startup configuration or the Windows user environment. Shell profiles are not dedicated secret stores and are frequently copied into: - Dotfile repositories - Workstation backups - Support and diagnostic bundles - Shared home-directory snapshots - Terminal configuration exports The commands also append repeated values without detecting or removing old keys. File permissions are not verified, and no rotation or cleanup workflow is provided. ### Attack Path 1. The user completes SMS onboarding and obtains an API key. 2. The user follows the documented persistence command. 3. The key is written unencrypted to `.bashrc`, `.zshrc`, or the Windows user environment. 4. Malware, another process under the same account, an unintended backup recipient, or an accidentally published dotfile repository obtains the key. 5. The attacker reuses the key against LinkFox services. ### Impact Assessment An exposed key may permit unauthorized API calls, depletion of paid credits, access to account-scoped functions, and correlation of activity with the affected user or team. The exact privilege depends on server-side token scope. This is documented persistence rather than a covert startup backdoor, but it unnecessarily increases the credential's lifetime and exposure surface. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skills/linkfox-report-generator/scripts/inject_report.py:158

Finding

Report Generator Injects Untrusted HTML and JavaScript Without Sanitization

Content

View full analysis

str: echarts_code = "" m = _ECHARTS_BLOCK_RE.search(content) if m: echarts_code = m.group(1).strip() echarts_code = _SCRIPT_OPEN_RE.sub("", echarts_code) content = _ECHARTS_BLOCK_RE.sub("", content).strip() canvas_code = "" m = _CANVAS_BLOCK_RE.search(content) if m: canvas_code = m.group(1).strip() canvas_code = _SCRIPT_OPEN_RE.sub("", canvas_code) content = _CANVAS_BLOCK_RE.sub("", content).strip() html = template.replace( "{{TITLE}}", title or "LinkFox Analysis Report", ) html = html.replace("{{LANG}}", language) html = re.sub( r".*?", "\n" + content + "\n", html, flags=re.DOTALL, ) if echarts_code: html = html.replace( "// ECHARTS_INIT_START\n // ECHARTS_INIT_END", "// ECHARTS_INIT_START\n " + echarts_code + "\n // ECHARTS_INIT_END", ) if canvas_code: html = html.replace( "// CANVAS_INIT_START\n // CANVAS_INIT_END", "// CANVAS_INIT_START\n " + canvas_code + "\n // CANVAS_INIT_END", ) return html ``` ### Technical Analysis The report fragment is inserted directly into the output document without HTML escaping or sanitization. JavaScript extracted from special blocks is also inserted as executable source. Removing literal opening and closing `

Remediation

View remediation

` and Unicode separator characters. 8. Add a restrictive Content Security Policy that disallows arbitrary inline scripts and external connections. 9. Add tests using event-handler injection, markup breakouts, script-block termination, and dangerous URL schemes. 10. Ensure the required report template is included in the package; the audited directory did not contain the referenced `assets/template-analysis.html`. ]]>

T08 · Insecure Dependencies

Warning

• Location: skills/linkfox-file-upload/scripts/linkfox_paths.py:362

Finding

Runtime Installation Guidance Uses Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:207

Finding

Arbitrary Media Downloads Permit Internal Network Access and Unbounded Resource Consumption

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (114)

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 237)May include surrounding context.

python

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

Tainted flow: 'req' from os.environ.get (line 335, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request forwards sensitive environment values, including the API key in Authorization and several context headers, to a base URL that can be overridden by the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable or execution environment, they can redirect requests to an attacker-controlled host and exfiltrate credentials and metadata.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/aigc_textgen.py (reported line 337)May include surrounding context.

python

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The script allows API base URLs to be overridden via environment variables and then sends sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, to those endpoints with requests.post. In an agent/runtime environment where env vars may be attacker-controlled or influenced by another component, this becomes an exfiltration primitive that can redirect authentication and token-generation traffic to attacker infrastructure.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is also derived from environment-controlled base URLs and used to construct urllib requests carrying the Authorization header from LINKFOX_AGENT_API_KEY. If an attacker can set LINKFOX_AGENT_API_URL or related fallback variables, all authenticated gateway traffic can be redirected to a malicious server and the API key exposed.

Content

Scanner excerpt · skills/linkfox-aigc-textgen/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 151, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search-competition/scripts/batch_keepa_fetch.py (reported line 153)May include surrounding context.

python

}
    req = Request(api_url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search-competition/scripts/linkfox_paths.py (reported line 504)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The request sent to the gateway includes multiple headers sourced directly from environment variables, including SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME, and the destination host is also overrideable via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration path: in a hostile or misconfigured runtime, attacker-controlled environment values can be transmitted to an arbitrary remote endpoint without validation, which is especially risky for agent execution environments carrying sensitive metadata or secrets.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/amazon_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search/scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The request destination is controlled by LINKFOX_TOOL_GATEWAY from the environment, and the code sends the Authorization API token to that host without verifying it is trusted. If an attacker can influence environment configuration, credentials can be redirected to an attacker endpoint, causing secret exfiltration.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The download_media function performs arbitrary outbound HTTP(S) requests to a caller-supplied URL with no allowlist, destination validation, or SSRF protections. In an agent/runtime environment, this can be abused to reach internal services, metadata endpoints, or attacker-controlled hosts and then persist downloaded content locally.

Content

Scanner excerpt · skills/linkfox-file-upload/scripts/linkfox_paths.py (reported line 524)May include surrounding context.

python

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-amazon-search-competition/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · skills/linkfox-report-generator/scripts/linkfox_paths.py (reported line 281)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": api_token},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                body = json.loads(resp.read().decode())
            break
        except urllib.error.HTTPError as e:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill explicitly allows cloud upload to obtain public HTTPS URLs and references remote media download and local persistence patterns via companion tools, while presenting itself mainly as an analysis expert. In context, this makes accidental data disclosure more plausible because export functionality is adjacent to sensitive market-analysis outputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill includes a meta-capability to create or modify other skills through expert-skill-creator, which is unrelated to SERP analysis and significantly expands authority. This is dangerous because it enables capability creep and potential privilege escalation from a seemingly narrow business-analysis skill into a skill-authoring surface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The referenced API documentation is for a different skill capability entirely: asynchronous AI text generation plus feedback submission, not Amazon SERP market-structure analysis. This kind of skill-to-API mismatch is dangerous because it can cause the agent to send user inputs to an unrelated external service, expanding data exposure and creating a supply-chain style integrity problem where the skill does something materially different from its stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file documents authentication recovery, phone-based registration, API key provisioning, and billing/payment flows that are unrelated to the stated SERP market-structure analysis purpose. This scope mismatch increases the chance that the skill can collect credentials, phone numbers, or payment-related data under false pretenses, creating an unnecessary trust and abuse surface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.