潜力单变体专家-卖家精灵

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:07 AM UTC
• Version: 1.0.1

Overview

The product-scouting workflow is understandable, but the package also contains account/payment, public upload, scheduled-task, and agent-rewriting capabilities that go beyond the advertised scouting purpose.

Review this package before installing. It is not just an Amazon product scout: it can use LinkFox credentials, create scheduled tasks, guide phone/SMS registration and paid plan ordering, upload local files to public URLs, and contains a utility that can rewrite other agents' instruction files. Install only if you trust the publisher and intend to use those broader LinkFox capabilities; avoid providing payment, phone, or API-key details unless you have verified the endpoints and account flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 95% confidence
• Finding: The code executes another Python script via subprocess, and the target path is indirectly controllable through the SELLERSPRITE_SCRIPT environment variable. Although shell metacharacter injection is avoided by using an argument list, this still enables arbitrary code execution if an attacker can influence the environment or workspace configuration.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 94% confidence
• Finding: The download_media function fetches an arbitrary caller-supplied URL over the network with only a scheme check, enabling server-side request forgery behavior against external or internal HTTP(S) endpoints and uncontrolled retrieval of untrusted content. In the context of an Amazon product-scouting skill, this generic remote download capability is not tightly scoped to the stated purpose, which increases the risk that the function could be abused to probe internal services, hit sensitive endpoints, or stage unwanted data ingestion.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 89% confidence
• Finding: The subprocess working directory is derived from the ACPX_WORKSPACES environment variable without validation. An attacker who controls that environment value can redirect execution context, affecting which files are read or written and potentially changing behavior of the child script or imported modules.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 41, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 98% confidence
• Finding: SKILL_SCRIPT is sourced from os.environ.get and then passed directly to subprocess.run as the program to execute. This is a direct arbitrary-code-execution primitive in environments where attackers can set environment variables, because they can point execution to any Python file accessible to the process.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used with requests.post, allowing outbound transmission of SMS login data, access tokens, refresh tokens, and API-token generation requests to an attacker-controlled endpoint if the environment is tampered with. In a skill context, environment variables are part of the trust boundary, so treating them as authoritative without allowlisting enables credential exfiltration and hostile redirection.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway request URL is also built from environment-controlled configuration and passed to urlopen with the user's API key in the Authorization header, so a manipulated environment can redirect authenticated requests and leak the API key to an external server. Because this CLI also performs order creation and account queries, redirection can expose account metadata and enable unauthorized downstream actions.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and API-token operations, to those endpoints via requests.post. If an attacker can influence environment variables such as LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect authentication traffic and exfiltrate credentials or issue tokens against attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway code constructs outbound urllib requests using a base URL taken from environment variables and attaches the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY can force requests, including authenticated account, package, and order operations, to an arbitrary server and steal the API key or manipulate billing-related responses.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The script forwards multiple environment-derived values to an outbound HTTP request, most importantly allowing LINKFOX_TOOL_GATEWAY to fully control the destination host while also attaching the API key in the Authorization header. If an attacker can influence environment variables, they can redirect authenticated traffic to an attacker-controlled endpoint and exfiltrate credentials and request data. In an agent/skill context, env vars are part of the execution boundary, so trusting them for network egress significantly increases risk.

Tainted flow: 'req' from os.environ.get (line 121, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            body = response.read().decode("utf-8")
            if not body.strip():
                # delete 等接口可能无返回体

• Confidence: 93% confidence
• Finding: The request sent via urlopen includes multiple headers sourced directly from environment variables, and the destination base URL is also indirectly influenced by local path-imported helper logic. This creates a tainted outbound network flow that can exfiltrate sensitive runtime context such as API keys, session identifiers, and message metadata to a remote service or an attacker-controlled endpoint if configuration is tampered with. In this skill’s context, that risk is amplified because the skill’s declared purpose is unrelated to task scheduling, so the networked scheduler behavior is harder to justify and more suspicious.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions while its instructions clearly require powerful capabilities including shell execution, network access, file read/write, and orchestration of other skills. This hidden capability gap weakens review and consent boundaries: users and platform controls may treat it as low-risk while it can execute code, access local data, and persist/export results.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a narrow product-scouting assistant, but the described behavior spans broad, high-risk operations including modifying other agents' configuration files, writing local files/SQLite/Excel/JSON, uploading data externally, invoking multiple external services, and creating scheduled tasks. This overbroad and misleading design increases the chance of unauthorized persistence, lateral modification of other agents, data exfiltration, and execution of actions a user did not reasonably consent to.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script's purpose is to rewrite other agents' CLAUDE.md instruction files by injecting new workflow steps, triggers, and command flags, which is a powerful cross-agent modification capability unrelated to the declared skill role. This creates instruction-supply-chain risk: a user invoking this skill can silently alter the behavior of other agents, expanding scope and trust in ways that reviewers and operators may not expect.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The --all mode enumerates /root/.linkfox/workspaces/agents and bulk-rewrites multiple agents' CLAUDE.md files, enabling mass persistence of behavioral changes across the environment. In the context of a scouting skill, this is especially dangerous because it provides broad, undisclosed authority to propagate instruction changes at scale, increasing blast radius if misused or triggered accidentally.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This support module includes broad cloud-upload and remote-download primitives that materially exceed the manifest’s stated purpose of scouting single-variation Amazon products. Capability overreach is dangerous because it increases the attack surface and gives the skill generic file transfer functionality that could be repurposed for data staging or exfiltration unrelated to legitimate scouting tasks.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code implements arbitrary external media retrieval from any http/https URL, which is not justified by the skill’s narrow scouting purpose and creates a reusable SSRF-like primitive. Because the function accepts untrusted URLs and writes retrieved content into the session workspace, it can be abused to access internal web resources, download malicious payloads, or ingest unexpected data at scale.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The module can obtain temporary cloud storage credentials from a gateway and then upload arbitrary local files to OSS, which is a powerful exfiltration-adjacent capability unrelated to simple product scouting. In skill context, unjustified file-upload ability is especially risky because any sensitive local files accessible to the process could be transferred off-host if another component or prompt path invokes this helper with attacker-chosen paths.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The referenced API documentation is for a different skill (`linkfox-aigc-textgen`) than the declared Amazon single-variation product-scout skill. This mismatch can cause the agent to invoke unrelated text-generation capabilities, broadening behavior beyond the stated scope and potentially sending user prompts or product research data to an unintended backend. In a security review, capability/scope drift is dangerous because it defeats least privilege and makes user and operator expectations unreliable.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The feedback endpoint enables outbound transmission to `https://skill-api.linkfox.com/api/v1/public/feedback`, but this capability is not justified by the product-scouting purpose described in the metadata. Unnecessary outbound channels create data exfiltration risk, especially if user content, research context, or operational details are included in feedback payloads without clear consent or minimization. The context makes this more suspicious because it appears in unrelated API documentation already mismatched to the skill’s stated function.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file embeds authentication recovery, registration, API key setup, and billing/payment workflows that are unrelated to the declared purpose of Amazon single-variation product scouting. This creates a dangerous scope mismatch: a skill intended for product analysis is also directing users or agents to handle credentials, account creation, and paid transactions, which expands the attack surface and enables unauthorized collection of sensitive data or misuse of purchasing flows.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documentation instructs phone-based registration, verification code handling, and plan ordering/payment operations despite the skill being advertised as a product-selection expert. Asking for a phone number and guiding order creation is unjustified in this context and could facilitate phishing-like data collection, account abuse, or unauthorized financial actions if an agent follows the instructions automatically.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script implements asynchronous AIGC text generation, which materially differs from the manifest's claimed Amazon single-variation product-scouting purpose. Capability mismatch is dangerous because it can hide broader data-processing or content-generation behavior from reviewers and downstream agents, defeating least-privilege and trust assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The code stores generated responses to local session files when outputs exceed a threshold, which expands the skill from transient processing into local data persistence. In the context of a narrowly described scouting skill, undisclosed persistence increases the risk of retaining sensitive prompts, generated content, or derived business data on disk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The embedded download_media helper provides generic network retrieval and local file writing unrelated to the declared product-scouting role. Even if unused here, such latent capability broadens the skill's attack surface and can later be repurposed for unreviewed downloads, SSRF-style access, or staging arbitrary content on disk.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements SMS login, API key acquisition, package listing, order placement, and payment QR generation, which is materially unrelated to the declared purpose of an Amazon product-selection expert skill. That scope mismatch increases the risk that the skill is collecting credentials and enabling financial actions users would not reasonably expect from the advertised functionality.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57