未满足需求挖掘专家

• Outcome: Review
• Latest audit: Aug 9, 2026 · 5:08 AM UTC
• Version: 1.0.1

Overview

This skill mainly supports Amazon product research, but it also bundles sensitive account, payment, scheduling, feedback, and agent-instruction editing capabilities that need review before installation.

Install only if you are comfortable with this skill using LinkFox API credentials, writing full result files locally, creating scheduled future agent tasks, guiding account registration and paid plan orders, and potentially uploading files or sending feedback externally. Avoid using it in environments where service endpoint environment variables can be influenced by untrusted parties, and do not run the agent-patching script unless you explicitly intend to modify other agents' instructions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 97% confidence
• Finding: The code executes another Python script via subprocess using a path that is partially controlled by the SELLERSPRITE_SCRIPT environment variable. Although it avoids shell=True, this still enables arbitrary code execution if an attacker can influence the environment or skill workspace, which is especially risky in agent/runtime environments where environment variables may be user- or platform-influenced.

Tainted flow: 'req' from os.environ.get (line 274, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with urlopen(req, timeout=timeout) as resp:
            # 从 Content-Type 进一步修正扩展名
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")

• Confidence: 93% confidence
• Finding: `download_media()` performs outbound fetches to arbitrary caller-supplied URLs with only a scheme check for `http/https`. That enables server-side request forgery behavior against internal services, cloud metadata endpoints, or other sensitive network locations if untrusted input reaches this helper. In a shared utility used by multiple skills, this is more dangerous because many downstream callers may reuse it without adding their own allowlisting or host validation.

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 94% confidence
• Finding: The subprocess cwd is derived from ACPX_WORKSPACES or the current working directory with no trust boundary enforcement. If that environment value is attacker-controlled, the child process may run in a hostile directory, affecting imports, relative file access, and which resources the downstream script consumes, increasing the chance of arbitrary code or logic manipulation.

Tainted flow: 'SKILL_SCRIPT' from os.environ.get (line 81, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

call_params['size'] = PAGE_SIZE
    params_json = json.dumps(call_params, ensure_ascii=False)
    print(f"  Fetching page {page_num}...", end=" ", flush=True)
    result = subprocess.run([sys.executable, SKILL_SCRIPT, params_json], capture_output=True, text=True, cwd=os.environ.get("ACPX_WORKSPACES", os.getcwd()).split(os.pathsep)[0])
    if result.returncode != 0:
        print("FAILED"); print(f"  stderr: {result.stderr[:500]}"); return None
    saved_file = None

• Confidence: 99% confidence
• Finding: SKILL_SCRIPT is explicitly sourced from the SELLERSPRITE_SCRIPT environment variable and then passed directly to subprocess.run as the program to execute. This is a classic arbitrary code execution primitive: anyone able to set that variable can cause the agent to execute any Python file accessible to the process.

Tainted flow: 'req' from os.environ.get (line 334, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

}
    req = Request(url, data=data, headers=headers, method="POST")
    try:
        with urlopen(req, timeout=HTTP_TIMEOUT) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The script reads an API key from environment variables and sends it in the `Authorization` header to a URL derived from `LINKFOX_TOOL_GATEWAY`. Because that base URL is environment-controlled and not validated, a compromised runtime or untrusted launcher can redirect requests to an attacker-controlled host and capture the credential, creating a real secret-exfiltration risk.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The POST destination is derived from helper functions that read environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then the code sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and group identifiers to that URL. In a hostile or compromised runtime, an attacker can override these base URLs to exfiltrate credentials and session material to an attacker-controlled server.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request target is built from environment-controlled base URLs and then used with urlopen while attaching the API key as an Authorization header. If an attacker can influence LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY, they can redirect authenticated requests and steal the API key or manipulate billing and account actions.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, and the request may include sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, API tokens, and authorization headers. In an agent or hosted skill environment, an attacker who can influence environment variables can redirect these requests to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL used by urllib is also built from environment-controlled values and is sent with the LinkFox API key in the Authorization header. If the environment is tampered with, the CLI can be induced to send API credentials and order/account operations to an arbitrary endpoint, enabling token theft, fraudulent purchases, or manipulation of returned data.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request sent via urlopen includes headers populated from environment variables such as SESSION_ID, MODE_ID, APP_NAME, and the API endpoint itself can be overridden by LINKFOX_TOOL_GATEWAY. This creates a real tainted egress path: in an untrusted runtime, an attacker can redirect traffic to an attacker-controlled gateway and cause sensitive context and the API key in the Authorization header to be transmitted off-system.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions while its instructions clearly direct execution of shell commands, file reads/writes, networked sub-skills, and persistent automation. This creates a permission-transparency gap: reviewers and runtime policy may treat the skill as low-privilege even though it can access local files, invoke external services, and write outputs, increasing the chance of overbroad execution or unsafe data handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a product-research expert, but the described behavior expands into modifying external agents' CLAUDE.md files, persisting state, generating and uploading artifacts, invoking AIGC services, and even handling account/payment-related flows. That mismatch is dangerous because users and defenders may authorize it for benign market analysis while it actually has a much broader operational and supply-chain footprint, including the ability to alter other agents' instructions and exfiltrate or distribute generated data.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script’s behavior is materially inconsistent with the declared skill context: instead of performing unmet-demand mining, it injects new workflow instructions into other agents’ CLAUDE.md files to alter their behavior. This kind of hidden cross-agent modification is dangerous because it can silently expand capabilities, change decision logic, and bypass normal review boundaries for unrelated agents.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script can bulk-modify external agent CLAUDE.md files via user-provided paths or the --all mode that scans /root/.linkfox/workspaces/agents. In the context of a skill that should analyze Amazon demand gaps, mass-editing other agents’ instruction files is an over-privileged capability that could persistently alter agent behavior at scale and create a supply-chain style integrity risk inside the agent workspace.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The referenced API documentation describes a generic AI text-generation service for arbitrary prompts and media, which does not align with the declared unmet-demand mining purpose of the skill. This mismatch can enable scope creep and hidden data flows, allowing the skill to send broad user-provided content to a generic generation backend without clear necessity or least-privilege justification.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The feedback endpoint posts data to a separate external public API that is not justified by the skill's stated function. Because the content field can include user statements and operational context, this creates an unnecessary exfiltration channel and increases privacy and compliance risk, especially if user or workflow data is forwarded without explicit consent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This onboarding document introduces authentication recovery, phone-based registration, API key handling, and billing/purchase flows inside a skill whose stated purpose is unmet-demand mining for Amazon products. That is a dangerous scope expansion: it can cause the agent to collect sensitive user data, broker account creation, and facilitate payments unrelated to the declared business function, increasing the chance of credential abuse, privacy violations, and unauthorized transactions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The document explicitly instructs the agent to register users via phone verification and create paid plan orders, which is not justified by the market-analysis skill's purpose. This exposes users to sensitive-data collection and payment initiation through an agent path, creating clear opportunities for abuse, social engineering, and unauthorized account or billing actions.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file implements a generic AI text-generation client, while the manifest describes an unmet-demand mining expert. This capability mismatch is dangerous because it gives the skill broader behavior than users and policy controls would expect, increasing the chance of misuse, hidden data handling, or unsafe downstream chaining under a misleading label.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API key acquisition, plan listing, ordering, payment QR generation, and order status queries, which are unrelated to the advertised unmet-demand mining skill. That mismatch is dangerous because it introduces hidden authentication and payment capabilities into a context where users would not expect credential collection or billing actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The command handlers expose end-to-end account provisioning and commerce operations, including sending verification codes, logging in, generating API keys, creating orders, and rendering payment QR codes. In the context of a market-analysis skill, these capabilities materially increase abuse risk by enabling covert credential harvesting, account takeover assistance, and unauthorized billing workflows.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to automatically call a Feedback API whenever certain conditions occur, even though feedback collection is unrelated to the core product-search task. This creates an unnecessary secondary data flow that may transmit user content, tool outputs, or behavioral metadata to another endpoint without a clear need, increasing privacy and data-governance risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The document adds a separate feedback submission API that is unrelated to the core product-search capability of the skill. In an agent setting, this can create an unintended side-effect channel where user content, workflow details, or model-generated summaries are transmitted to an external endpoint without a clear user security boundary, increasing the risk of data exfiltration or unauthorized outbound actions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The onboarding guidance instructs the agent to handle account authentication recovery, phone-based registration, and billing purchase flows that are outside the declared purpose of unmet-demand mining. This expands the skill into sensitive account and payment operations, increasing the chance of credential mishandling, social engineering, and unauthorized financial actions if the agent follows these instructions automatically.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to collect a phone number, send a verification code, log in on the user's behalf, and initiate payment orders even though these capabilities are not justified by the product-demand-analysis use case. In this context, the mismatch is especially risky because unrelated sensitive workflows can be abused for account takeover assistance, privacy violations, or deceptive payment initiation under the cover of a benign analytics skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/linkfox-task-scheduler/references/api.md:57