谷歌趋势-热门词查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.6

Overview

This appears to be a real LinkFox Google Trends skill, but it also includes account login, API-key, payment, feedback, and local storage flows that should be reviewed before use.

Review this skill before installing. Use it only if you are comfortable with LinkFox receiving trend queries and, during setup or billing recovery, phone numbers, SMS codes, account tokens, API keys, and payment/order details. Prefer the self-service LinkFox website for account setup, verify endpoint environment variables are not overridden unexpectedly, and avoid sending sensitive conversation text through the feedback flow. Check or clean the local linkfox output/cache directories if stored responses should not remain on disk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, and the request can include sensitive authentication material such as access tokens, refresh tokens, UID headers, and phone/login data. In a hostile or misconfigured runtime, an attacker can redirect these requests to an arbitrary server and capture credentials or API keys. The mismatch between the skill’s Google Trends purpose and this onboarding/login behavior makes the risk more concerning, because the network transmission is unrelated to the declared functionality.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request URL is built from environment-derived base URLs and then used in urlopen with the Authorization header populated from environment-sourced API keys. If the environment is attacker-influenced, this causes credential exfiltration to arbitrary endpoints and could also enable unauthorized actions such as querying account data or creating orders against rogue infrastructure. Because this skill is supposed to analyze trends, not perform account and billing operations, this capability is unjustified and increases suspicion.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs use of environment variables, network access, and file writes, yet no explicit permission declaration is present. This creates a transparency and governance gap: an agent may access credentials, contact external services, and persist data locally without the platform or user having clear, reviewable permission boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a Google Trends lookup tool, but its referenced onboarding flow introduces account login, SMS verification, API-key generation, subscription browsing, order creation, and payment status handling. That is a substantial hidden expansion of behavior into authentication and billing workflows, which could cause users or agents to disclose credentials, trigger purchases, or process payment flows outside the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script persistently stores full API responses, cache entries, and session metadata on disk even though the skill's apparent purpose is just to fetch and analyze trends. If the API response contains sensitive account, usage, or query context data, this creates unnecessary local data retention and enlarges the exposure surface to other local users, later processes, backups, or accidental commits.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and then the system temp directory. This mismatch can cause sensitive response data to be written to less controlled locations than operators expect, undermining trust boundaries and incident review assumptions.

Description-Behavior Mismatch

Critical

• Confidence: 99% confidence
• Finding: The file implements LinkFox account onboarding, SMS login, API key retrieval, plan listing, ordering, and payment handling, which is unrelated to the advertised Google Trends analysis purpose. This kind of capability mismatch is dangerous because it can trick users or host systems into granting access to credential and billing operations under the guise of a harmless trend-analysis skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create paid orders and render payment QR codes, enabling commerce operations that are not justified by a trend-discovery skill. A user or agent invoking this skill could be steered into unauthorized purchases or social-engineered payment flows, especially if the capability is hidden behind unrelated metadata.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill performs SMS-based authentication, token handling, user/team discovery, and API key generation, none of which are necessary for Google Trends analysis. This creates a credential acquisition path that can expose users’ accounts and long-lived API access under misleading skill branding.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger text is overly broad and can activate on generic requests about popularity, trends, or what is hot, even when the user did not ask for Google Trends specifically. In a paid, networked skill, overbroad activation increases the chance of unintended external calls, unnecessary charges, and collection or storage of data without sufficiently clear user intent.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: Defaulting silently to the US region can cause the tool to query a third-party service for a geography the user did not request, producing misleading results and potentially incurring paid usage. In context, this is more risky because the skill has explicit cost and persistence behavior, so an implicit default can trigger billable, saved network activity without clear user approval.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The Feedback API documentation instructs clients to send free-form `content` to an external service but does not warn that this may include user-provided text or sensitive conversation context. In an agent setting, this omission can lead developers to automatically forward user content without consent, creating a privacy and data-exfiltration risk to a separate third-party endpoint.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The onboarding flow instructs the agent to collect a user's phone number and transmit it to an external registration/login script, but it does not require explicit notice, consent, or data-handling disclosure. This creates a privacy and compliance risk because users may provide personally identifiable information without understanding where it is sent, how it is stored, or what third party processes it.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The login flow returns the API key directly in stdout JSON, which is likely to be logged, captured in transcripts, or exposed to downstream tools. Even without overt exfiltration code, printing secrets to standard output is a common credential leakage pattern and is especially unsafe in agent environments with extensive logging.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 87% confidence
• Finding: This code transmits user and authentication data to external services via requests.post. External transmission alone is not always a flaw, but here it is part of an unrelated onboarding/auth flow inside a Google Trends skill, so the transmission materially increases the risk of unauthorized credential handling and disclosure.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.