ClawHub
Back to skill

Security audit

Jiimore-关键词细分市场

Security checks across malware telemetry and agentic risk

Overview

The skill does perform Amazon niche analysis, but it also includes account login, API key handling, paid order creation, automatic feedback reporting, and broad local response storage that deserve review before installation.

Install only if you are comfortable with LinkFox receiving keyword queries and related session metadata, with full API responses being saved locally, and with the skill guiding account login and paid credit purchase flows. Prefer obtaining and storing API keys yourself, review any payment order before scanning a QR code, avoid sharing SMS codes unless you intentionally choose that path, and be aware that feedback may be sent externally without a separate prompt.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
The request sent via urlopen includes environment-derived values in both the destination base URL and HTTP headers, so a compromised or attacker-controlled environment can redirect traffic to an arbitrary host and exfiltrate API credentials and session metadata. In an agent setting, trusting LINKFOX_TOOL_GATEWAY, SESSION_ID, MODE_ID, and APP_NAME without validation makes this a real SSRF/data-exfiltration risk rather than a harmless configuration detail.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
92% confidence
Finding
The code constructs request destinations from environment-controlled base URLs and sends sensitive onboarding/login data to them via requests.post. In a skill context, environment variables may be attacker-influenced or misconfigured, turning this into SSRF or credential exfiltration to an untrusted endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
91% confidence
Finding
The gateway request uses a URL built from environment-derived base paths and includes the API key in the Authorization header before calling urlopen. If an attacker can influence the environment, they can redirect requests and capture API keys or trigger server-side requests to arbitrary hosts.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill uses sensitive capabilities including environment-variable access, network access, and file writes without any declared permission model or explicit scoping. In an agent environment, this creates hidden side effects and prevents policy enforcement, making it easier for the skill to access secrets and persist data beyond what users would reasonably expect from a niche-analysis tool.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented behavior materially exceeds the stated purpose: beyond keyword niche analysis, the skill apparently supports authentication flows, account access, API key lifecycle actions, subscription/package browsing, paid order creation, payment QR generation, and order-status checks. This mismatch is dangerous because a user or orchestrator may invoke the skill under a low-risk market-research expectation while it can trigger identity, billing, and account-affecting actions.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill instructs the agent to always persist full API responses into the local project directory, which is a side effect unrelated to the core user-visible purpose of keyword analysis. This can leak proprietary query results, account-linked metadata, or other returned data into repositories, shared workspaces, or later agent contexts without clear user awareness.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
Auto-reporting feedback to a separate API introduces undisclosed outbound data flow beyond the niche-analysis task. User prompts, satisfaction signals, and operational details may be transmitted to another service without explicit consent, creating privacy and trust concerns especially because the feature is framed as non-interruptive and automatic.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The feedback-reporting behavior is not necessary to fulfill the stated analytical function, so it expands the skill's data-sharing surface without a task-based justification. Unnecessary external reporting increases privacy exposure and can be abused to exfiltrate user intent, tool failures, or business context under the guise of product improvement.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The documentation introduces a separate external feedback-submission API that is unrelated to the stated niche-analysis function of the skill. This expands the skill’s effective capability surface and could cause an agent to transmit user-derived content to a third-party endpoint without a clear functional need or explicit user request, creating unnecessary data disclosure risk.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The docstring promises that output is always written under the current working directory and that /tmp is forbidden, but the implementation falls back to the home directory and then the temp directory. This mismatch can cause sensitive API responses and session metadata to be stored in locations the user did not expect, weakening data handling guarantees and potentially exposing data through shared or less-protected paths.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill metadata describes Amazon niche keyword analysis, but the code implements account onboarding, SMS login, API key issuance, and payment flows. This capability mismatch is a strong indicator of deceptive or over-privileged behavior because it collects credentials and enables actions unrelated to the declared purpose.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The file can list plans, create orders, and generate payment QR codes despite the skill being marketed as market-analysis functionality. Hidden billing capabilities increase the risk of unauthorized purchases, coercive upsells, or user deception within an unrelated workflow.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code performs SMS verification, login, user/team enumeration, and API token retrieval/generation, all unrelated to keyword market analysis. In context, this is especially dangerous because the skill can harvest authentication material under a misleading description.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The feedback API section describes sending free-form `content` to an external service but does not warn that user text or interaction details may leave the current system. In an agent setting, this omission can lead to silent exfiltration of user-provided information, including potentially sensitive business context, complaints, or operational details.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The onboarding instructions explicitly direct collection and handling of a user's phone number and SMS-based authentication flow, but they do not include consent language, data minimization guidance, retention limits, or warnings about sensitive credential handling. In an agent context, this can lead to unnecessary exposure of personal data and account takeover risk if phone numbers, verification codes, or returned API keys are logged, echoed back, or mishandled.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script transmits user-provided JSON parameters plus session/app metadata to a remote endpoint without any consent prompt or narrowing of what metadata is necessary. In a skill context, users may expect keyword analysis, not silent forwarding of contextual identifiers, so this creates a privacy and data-sharing risk even if the endpoint is legitimate.

Missing User Warnings

High
Confidence
96% confidence
Finding
The login flow returns a live API key in stdout JSON, which may be captured by logs, agent transcripts, shell history tooling, or downstream components. Exposing credentials this way materially increases the chance of accidental leakage and account compromise.

Missing User Warnings

Medium
Confidence
77% confidence
Finding
The code writes payment QR images to a local session directory without warning the user or applying access controls. On shared systems, other users or processes may access the QR code and use or monitor the payment artifact, leaking transaction data or enabling unauthorized payment attempts.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
80% confidence
Finding
This is a real external transmission point, and in this file it carries sensitive login and account data. External transmission alone is not always unsafe, but combined with environment-controlled endpoints and credential handling it materially increases exfiltration risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.