谷歌趋势-关键词趋势

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.6

Overview

The skill can do the advertised Google Trends lookup, but it also adds high-impact onboarding, billing, credential persistence, local storage, and automatic feedback reporting that need review before installation.

Install only if you are comfortable with LinkFox receiving API requests and possible feedback content, and with the agent handling phone/SMS onboarding, API keys, and billing flows. Prefer setting API keys temporarily or through a secret manager, avoid running the onboarding/payment commands unless you explicitly intend to, and clear the local linkfox output/cache directories if the queries are sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities to read environment variables, write files, and make network calls, but no explicit permissions are declared. This creates hidden authority: an agent invoking the skill may access credentials, persist data locally, and contact external services without a clear permission boundary or user understanding. In this context, the risk is increased because the skill also instructs writing outputs to project-local storage and using API keys from the environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a Google Trends analysis tool, but the referenced onboarding flow expands behavior into account login, SMS verification, API-key generation, account inspection, subscription browsing, payment order creation, QR rendering, and payment-status queries. That is a major scope expansion into identity, billing, and credential handling, which can enable unintended account actions or social-engineering style data collection under the guise of trend analysis. The mismatch makes the behavior materially more dangerous because users and orchestrators may trust the skill with a much narrower purpose than it actually exercises.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to automatically send user feedback and interaction-derived judgments to a separate Feedback API. This introduces undisclosed secondary exfiltration of user content and metadata beyond the core Google Trends function, violating data minimization and potentially leaking sensitive requests, complaints, or business intent. The danger is amplified because it says not to interrupt user flow, discouraging transparency or consent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Auto-reporting satisfaction, mismatches, and improvement opportunities to an external API is unrelated to the skill's stated purpose of trend analysis. That unjustified expansion creates privacy and governance risk because user reactions and task details may be transmitted off-path without necessity, consent, or clear retention boundaries. In a business research context, even qualitative feedback can reveal sensitive plans or commercial interests.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documentation adds a separate feedback-posting API that is unrelated to the core Google Trends lookup capability. In an agent skill context, this expands behavior from read-only data retrieval to outbound submission of content, creating a risk that user data or conversation content could be transmitted to a third party without clear necessity, consent, or tight scoping.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file header promises responses are always written under the current working directory and explicitly forbids /tmp, but the implementation falls back to ~/linkfox and then the system temp directory. That mismatch can cause sensitive API responses and session metadata to be stored in less protected or unexpected locations, undermining operator assumptions about data handling.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The skill creates persistent session directories, _meta.json files, and a root index.jsonl tracking session IDs, timestamps, and invoked skills. For a keyword-trend lookup tool, this exceeds the minimal function needed and increases privacy and data-retention exposure if local files are accessible to other users or later processes.

Description-Behavior Mismatch

Critical

• Confidence: 99% confidence
• Finding: This skill claims to provide Google Trends analysis, but the code is a LinkFox onboarding and payment CLI that handles SMS login, API key acquisition, package listing, ordering, and payment QR generation. That mismatch is a strong indicator of deceptive packaging intended to obtain credentials or monetize access under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code implements SMS-based login, token exchange, team discovery, and API token generation, none of which are necessary for a Google Trends keyword analysis skill. In this context, these capabilities enable credential capture and unauthorized expansion of access by turning a user's phone verification flow into API key retrieval.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The package listing, order creation, and payment QR generation flows are unrelated to Google Trends analysis and introduce financial transaction capability into an unrelated skill. This broadens harm from data misuse to unauthorized purchases, social engineering, and deceptive monetization.

Vague Triggers

High

• Confidence: 85% confidence
• Finding: The trigger criteria are broad enough to activate on generic trend-analysis or market-research requests, even when the user did not ask for Google Trends specifically. Over-broad activation can cause the wrong tool to run, increasing unnecessary data sharing, unwanted API spending, and misleading results because Google Trends only provides normalized search-interest data. The surrounding context makes this more risky because the skill can also write outputs to disk and invoke external services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The feedback API explicitly accepts free-form `content` and suggests sending what the user said or intended, but the documentation provides no privacy warning, consent requirement, or restriction against including sensitive conversation data. This can lead to unreviewed exfiltration of user prompts, personal information, or confidential business context to an external endpoint.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The onboarding instructions explicitly tell the agent to ask for and process a user's phone number so a local script can register or log in on the user's behalf, but they provide no consent, retention, or privacy warning. In an agent context, this increases the risk of unnecessary collection of sensitive personal data and unsafe handling of verification flows that could expose users to account takeover or privacy abuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file instructs users to persist API keys into shell profiles and even immediately source those profiles, but it omits warnings about credential exposure, shell history leakage, multi-user system risks, and permanent modification of startup files. In a skill run by an agent, these commands can normalize unsafe secret handling and lead to long-lived credential compromise if copied blindly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The CLI emits a newly obtained API key directly to stdout as JSON, which can be captured by logs, terminal history, wrappers, or downstream tools. Exposing long-lived credentials in routine output materially increases the chance of accidental disclosure and later account misuse.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill mandates always writing full API responses to session-scoped files under the current project directory. Persistent local storage of full responses can expose user-provided terms, account-related metadata, or other sensitive API fields to unrelated tools, collaborators, source control, backups, or later sessions, especially because the path is predictable and tied to the working directory. The risk is higher here because the skill also references environment-based authentication and broader onboarding/payment flows.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.