Jiimore-ASIN细分市场

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:16 AM UTC
• Version: 1.0.3

Overview

The skill performs ASIN market analysis but also includes account login, API-key generation, payment-order creation, automatic feedback reporting, and broad local persistence that need review before installation.

Review this skill carefully before installing. It is not just an ASIN lookup helper: it can guide users through LinkFox account setup, handle phone/SMS login, expose generated API keys in command output, create payment orders, send feedback to a separate service, and write full responses locally. Use only with a trusted LinkFox account, avoid entering SMS codes or secrets through logged command lines, verify all endpoint environment variables, and treat generated API keys as sensitive credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:218

Finding

Automatic Feedback Instructions Can Disclose User Content Without Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:487

Finding

Generated API Key Is Printed in Plaintext to Standard Output

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboarding instructions additionally tell the agent to forward the key to the user and place it directly in shell commands. ### Technical Analysis The login command emits the complete API key in JSON on standard output. In an agent or automation environment, stdout is commonly retained in execution transcripts, observability systems, CI logs, terminal scrollback, and conversation context. This unnecessarily expands the credential’s exposure surface. The key authorizes billable API calls and is also used by the onboarding script to retrieve account information, list plans, create payment orders, and query orders. It is therefore not merely a public identifier. Returning the raw key from a dedicated credential operation may be functionally necessary at one boundary, but printing it into general-purpose stdout and asking an agent to relay it is not a least-privilege delivery mechanism. ### Attack Path 1. A user provides a phone number and SMS code to the onboarding command. 2. The script logs in, requests or generates an API token, and stores it in `r["api_key"]`. 3. `_emit(r)` serializes the entire response, including the unmasked token, to std ...[truncated 676 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:576

Finding

SMS Verification Code Is Accepted as a Command-Line Argument

Content

View full analysis

``` ### Technical Analysis The phone number and one-time SMS verification code are supplied as positional command-line arguments. Command arguments can be recorded in shell history, agent tool-call history, process-monitoring telemetry, audit logs, and, on some systems, process listings visible to other users. Although the code is short-lived, the verification code is an authentication factor capable of initiating a login and API-key generation flow during its validity period. Passing it through a broadly observable channel violates least-privilege handling of authentication data. ### Attack Path 1. The user invokes the documented login command with a valid phone number and SMS code. 2. The shell or agent framework records the complete command. 3. A local user, logging service, extension, or transcript reader observes the arguments while the code remains valid. 4. The observer submits the same phone number and code to the LinkFox login endpoint. 5. If server-side replay controls do not invalidate the first use immediately, the observer obtains access tokens or generates an API key. ### Impact Assessment Successful exploitation can compromise the user’s LinkFox account onboarding session and expose or generate API credentials. Even when the OTP cannot be replayed, the command permanently discloses the user’s phone number in shell and agent history. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jiimore_get_niche_info_by_asin.py:38

Finding

Unvalidated Gateway Override Can Redirect Credentials and Request Metadata

Content

View full analysis

str: """Gateway base URL: env LINKFOX_TOOL_GATEWAY first, otherwise production.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared") ) return get_api_base() + API_PATH def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Equivalent unrestricted base-URL overrides also exist in `scripts/onboarding.py` for the gateway, login API, and agent-user API. ### Technical Analysis The destination receiving the authorization key is fully controlled by `LINKFOX_TOOL_GATEWAY`. The code does not require HTTPS, validate the hostname, pin an expected service domain, or require an explicit development-mode opt-in. As a result, an incorrect or attacker-influenced environment can redirect the API key and ASIN query to an arbitrary HTTP or HTTPS endpoint. If an `http://` URL is supplied, the credential can also be transmitted without transport encryption. The request s ...[truncated 1429 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jiimore_get_niche_info_by_asin.py:181

Finding

Unsanitized Session Identifier and Predictable Temporary Fallback Permit Output Redirection

Content

View full analysis

str: candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) import tempfile candidates.append(os.path.join(tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _SESSION_CACHE["_root"] = root return root def _session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` A similar unsanitized `SESSION_ID` join and temporary-directory fallback exists in `scripts/onboarding.py`. ### Technical Analysis `SESSION_ID` is used as a path component without rejecting absolute p ...[truncated 2052 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request sent to the gateway includes multiple headers populated directly from environment variables, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration channel for session/application metadata and the API key to any attacker-controlled endpoint if the environment is influenced, which is more dangerous than a normal API client because the skill claims a narrow read-only analysis purpose while silently exporting contextual metadata over the network.

Content

Scanner excerpt · scripts/jiimore_get_niche_info_by_asin.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The POST target is derived from environment-controlled base URLs, and the request may include sensitive material such as SMS-login tokens, refresh tokens, API-token generation requests, and identifying headers. In a skill context, allowing runtime environment variables to redirect these flows can enable exfiltration of credentials and account metadata to attacker-controlled infrastructure via SSRF-style endpoint substitution.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The gateway URL is also built from environment-controlled input and then used in urlopen with the bearer API key in the Authorization header. If an attacker can influence the environment or packaging/runtime configuration, they can redirect authenticated billing, account, and order traffic to a hostile endpoint and capture API keys or manipulate responses.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest presents a niche-analysis skill, but the documented behavior reportedly includes phone-login, API-key generation, account/team lookup, package listing, order creation, payment QR generation, and payment-status polling. That is a major scope expansion into identity, billing, and account operations, which can surprise users and enable unintended account or payment actions under the guise of market research.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are overly broad, allowing the skill to trigger even when the user does not explicitly mention ASIN or niche analysis. In practice, this can cause the agent to invoke a paid, networked, data-writing skill for loosely related requests, increasing the risk of unwanted charges, unnecessary data transfer, and user confusion about why the skill was used.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

}

text

## Display Rules

1. **Present data clearly**: Show query results in well-structured tables. Convert decimal ratios to percentages for readability (e.g., 0.25 -> 25%).
2. **Highlight key metrics**: Always surface the niche title, demand score, weekly search volume, weekly sales, brand count, and top 5 brands click share as primary columns.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file documents authentication recovery, account registration by phone number, and billing/payment handling that are unrelated to the declared purpose of an ASIN niche-analysis skill. This expands the skill’s operational scope into credential handling and commerce flows, increasing the chance the agent will solicit secrets or personal data and perform sensitive actions outside user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented workflow allows collecting a user’s phone number, sending login codes, logging in on the user’s behalf, and helping initiate payment orders, none of which are justified by the skill’s market-analysis function. In context, this is especially dangerous because users invoking an ASIN analysis skill would not reasonably expect identity enrollment or payment orchestration, creating strong phishing and privacy-abuse risk.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file is an onboarding, login, subscription, and payment CLI, not an ASIN niche-analysis tool as declared by the skill metadata. This mismatch is dangerous because it introduces hidden account-access and monetization capabilities under a misleading skill description, increasing the chance that users or reviewers grant trust to functionality they did not intend to invoke.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module docstring openly describes LinkFox account onboarding and payment operations, directly contradicting the published skill purpose of ASIN niche analysis. This deception is itself a strong risk signal because it indicates the skill is packaged to appear safer and narrower than its actual capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code can create orders, determine team billing paths, and return payment QR content and URLs despite the skill claiming to perform read-only market analysis. In-context, billing operations are substantially more dangerous because they can trigger financial actions unrelated to the user’s expected ASIN research workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill can send SMS verification codes, log users into LinkFox accounts, exchange tokens, inspect team membership, and generate API keys, none of which is justified by ASIN niche analysis. In this context, these capabilities enable credential acquisition and account bootstrapping under false pretenses, making the mismatch more severe than a normal utility script.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares capabilities consistent with environment-variable access, file writes, and network use, but does not scope or disclose those powers through an explicit permission model. That increases the chance of over-privileged execution and makes it harder for reviewers or users to understand that the skill can read secrets, persist data locally, and contact remote services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description is written as an instruction that the skill triggers on Chinese and English phrases, but it does not offer any user language choice while embedding Chinese-first behavior in the core description. Under the policy, language or locale constraints should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill mandates persistent local storage of every full API response and optionally prints the full response to stdout, despite being described primarily as an analysis skill. Persistent storage and broad stdout emission increase the risk of leaking proprietary market data, user-supplied identifiers, or account-linked metadata into project directories, logs, transcripts, or downstream tooling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatic feedback reporting adds an undeclared telemetry/reporting function that is outside the stated purpose of ASIN niche analysis. Sending user feedback or inferred dissatisfaction to an external API without explicit consent can leak conversation-derived data and creates a hidden network side effect unrelated to the core task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to auto-detect and submit feedback whenever the user expresses praise, dissatisfaction, or whenever the model thinks something could be improved creates broad telemetry exfiltration potential. Because the triggers are subjective and expansive, the skill could send conversational context externally without necessity or clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation instructs transmitting an API key in the Authorization header and sending ASIN/query data to an external gateway, but provides no user-facing warning about outbound network access, credential handling, logging, or retention. In an agent setting, missing disclosure increases the chance that secrets or sensitive commercial research inputs are sent off-platform without informed approval or proper safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 167)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/jiimore/getNicheInfoByAsin \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file documents a separate feedback endpoint that is unrelated to the stated ASIN niche-analysis function, expanding the skill's data flows beyond what a user would reasonably expect. Because the feedback payload can include free-form content about what the user said or intended, this creates a risk of sending user-derived data to a second external service without clear necessity, consent, or minimization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The feedback section sends structured content, potentially including user statements and outcome summaries, to a different external domain without any privacy warning or limitation guidance. This is more dangerous in skill context because the endpoint is not part of the core niche-analysis workflow, so operators may overlook that user-related text is being exported to a second service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly tell the operator to ask for a user’s phone number and pass it to a script, but provide no privacy notice, data-handling explanation, retention limits, or consent language. That creates unnecessary personal-data collection risk and can expose users to account takeover, unwanted contact, or mishandling of sensitive identifiers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly says writing to /tmp is forbidden and failure should occur if the current directory is not writable, but the implementation silently falls back to home and temp storage. This mismatch is security-relevant because operators and reviewers may rely on the documented constraints while the actual code persists data in less expected locations, undermining trust boundaries and auditability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The network request includes SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME from the environment without disclosure or visible necessity in the code path. While these values may be operational metadata, sending them expands data sharing beyond the core ASIN lookup purpose and can leak workflow context to the remote service or any redirected endpoint.

Content

No source excerpt is available for this finding.