前三页市场格局分析专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:07 AM UTC
• Version: 1.0.1

Overview

The skill mainly performs Amazon SERP analysis, but it also includes account/payment workflows, public upload capability, endpoint-overridable credentialed requests, and skill self-extension instructions that deserve review before installation.

Install only if you trust LinkFox as the API, billing, and file-hosting provider. Keep gateway/login environment variables pointed at official LinkFox hosts, avoid uploading private reports unless a public URL is intended, review any phone/SMS or payment prompts carefully, and do not allow the self-extension workflow to add new skills without a separate review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material to those endpoints via requests.post. In this script, those requests carry phone numbers, SMS codes, access tokens, refresh tokens, and API-token generation traffic, so a modified environment can redirect secrets to an attacker-controlled server.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is derived from environment variables and then used by urllib.request.urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. That creates a direct exfiltration path where a hostile environment can redirect authenticated requests, account metadata, order operations, and billing actions to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 150, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(api_url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The script forwards environment-derived values (SESSION_ID, MODE_ID, APP_NAME) as HTTP headers to an external API endpoint. Even if intended for internal routing or telemetry, these values may contain sensitive session or tenant context and are transmitted without validation, minimization, or explicit user consent, creating a real risk of context leakage to remote services.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 93% confidence
• Finding: `download_media()` performs outbound requests to any caller-supplied `http`/`https` URL and writes the response to disk, which creates a server-side request forgery/data-fetch primitive. Even though non-HTTP schemes are blocked, an attacker can still target internal services, cloud metadata endpoints, or unexpected external hosts, making this dangerous in a skill whose stated purpose is SERP analysis rather than arbitrary network retrieval.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation describes capabilities that imply environment access, local file read/write, and network operations, yet no explicit permissions are declared. This creates a transparency and least-privilege problem: users and reviewers cannot accurately assess what the skill may access or modify, and hidden capability scope increases the blast radius if downstream tools are misused.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is SERP market analysis, but the documented behavior extends into unrelated sensitive actions: account login flows, SMS verification, API key retrieval/generation, subscription/payment handling, public file upload, and HTML injection into reports. This mismatch is dangerous because it hides materially broader authority than users would expect, enabling credential, billing, privacy, and content-manipulation risks under the cover of a benign analytics skill.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill documentation allows the agent to modify the skill set itself by invoking a skill-creation tool on demand. Self-extension materially changes trust boundaries: a user invoking a market-analysis skill could indirectly trigger creation of new capabilities that were not part of the original review scope.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: On-demand invocation of a skill-creation tool is unjustified for a SERP analysis skill and significantly expands the attack surface. An attacker could use innocuous analysis requests as a stepping stone to obtain new capabilities, bypassing the principle that tools should be tightly scoped to their stated function.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The skill states that image/video generation is 'not applicable' for this skill, yet elsewhere instructs agents to automatically chain into image/video generation skills when certain requests are detected. This creates policy and capability ambiguity that can cause agents to invoke more powerful downstream actions than the user or operator expects, increasing the chance of unintended content generation, billing consumption, and unsafe workflow expansion.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documentation embeds mandatory orchestration rules telling the agent to automatically call downstream AIGC generation skills and pass generated content into them. This effectively turns a text-generation skill into a cross-tool controller, broadening its authority and enabling implicit data flow of prompts and media-derived content into other tools without a clear trust boundary or separate authorization step.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The referenced API documentation is for a generic AI text-generation and feedback service, which does not align with the declared purpose of a SERP market-structure analysis skill. This kind of capability mismatch is dangerous because it can hide undeclared data flows: user prompts, media URLs, and generated content may be sent to an unrelated external service under the guise of a different skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file documents an external feedback submission endpoint that is unrelated to the stated SERP analysis function. This creates an unjustified outbound communication path that could be used to exfiltrate user content or operational metadata, especially if an agent forwards conversational summaries or user complaints without clear consent.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This onboarding document introduces authentication recovery, phone-based registration, and billing/payment workflows that are unrelated to the stated SERP market-structure analysis purpose. That scope expansion is dangerous because it enables the skill to solicit credentials, personal data, and payment actions under the cover of an unrelated analysis tool, increasing phishing and abuse risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file instructs the operator to collect a user's phone number, perform login/registration steps, and create payment orders, none of which are justified by a SERP analysis skill. In this context, these capabilities materially increase the chance of unauthorized account actions, social engineering, and collection of sensitive personal and financial data.

Description-Behavior Mismatch

High

• Confidence: 87% confidence
• Finding: The file implements a generic asynchronous AI text-generation client, while the skill metadata claims an Amazon SERP market-structure analysis capability. This mismatch increases the chance that users or orchestrators send broader prompts and sensitive business data to a generic remote text-generation backend under a narrower, misleading skill label, weakening trust and review boundaries.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS login, API-key issuance, package listing, ordering, and payment QR generation, which is unrelated to the declared SERP market-analysis purpose of the skill. This capability mismatch is dangerous because it introduces hidden credential collection and commercial transaction functionality users would not reasonably expect from the skill context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script can log users in by SMS, obtain or generate API keys, and trigger paid orders with rendered payment QR codes. In the context of a SERP analysis skill, this is unjustified high-risk functionality that could be used to harvest credentials, provision persistent access, and induce unauthorized purchases.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This shared utility includes both arbitrary remote download and cloud upload capabilities, which materially exceed the declared scope of a SERP market-structure analysis skill. Such scope expansion increases attack surface and enables data movement paths that could be abused for exfiltration, staging, or retrieval of untrusted content if higher-level callers pass attacker-controlled inputs.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module is documented to consume an API key from the environment and use it to obtain upload credentials, which is outside the narrow needs of local path management for SERP analytics. In this context, credential use plus remote service access broadens what the skill can do and raises the consequences of misconfiguration or abuse, especially if the gateway target can be redirected.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill adds automatic feedback reporting behavior that is outside its stated Amazon SERP search purpose. This creates an unjustified secondary data flow where user prompts, satisfaction signals, or task context may be transmitted to another API without clear necessity, notice, or consent.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Automatically sending user feedback to a Feedback API is not required to perform SERP retrieval or ranking analysis. Because the trigger includes praise, dissatisfaction, and perceived improvement opportunities, the agent may exfiltrate user interaction content and sentiment to a third party without a clear functional justification.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file introduces authentication recovery, phone-based registration, and billing/purchase workflows inside a skill whose stated purpose is Amazon SERP market-structure analysis. This expands the skill's operational scope into account provisioning and payments, creating unnecessary attack surface and increasing the chance that an analysis workflow collects sensitive data or drives users into unrelated transactions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly instructs operators to collect a user's phone number, register an account, list plans, and create payment orders, none of which are justified by the declared analytics function. In the context of an agent skill, these steps can normalize sensitive-data handling and payment initiation through an untrusted workflow, which is risky even if not overtly malicious.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation claims writes must stay under the current project directory and that /tmp must not be used, but the implementation falls back to ~/linkfox and the system temporary directory. In a sensitive agent environment, this can cause data to be written outside the expected workspace boundary, increasing the risk of unintended persistence, cross-session exposure, or policy bypass.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS login, API key issuance, plan purchase, and payment QR generation, which is materially unrelated to the stated SERP market-structure analysis purpose. This mismatch is dangerous because it creates an unnecessary credential-collection and monetization workflow inside a skill that users would reasonably expect to perform analysis, increasing phishing and abuse risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.