Security audit

Jiimore-关键词细分市场

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main market-analysis function is legitimate, but it also handles authentication, API keys, payments, automatic feedback reporting, and persistent local outputs with insufficient scoping and disclosure.

Review this skill carefully before installing. It may be useful for paid LinkFox/Jiimore niche analysis, but it can collect phone/SMS login data, expose API keys in command output, guide users into plaintext key storage, create payment orders, send automatic feedback to a separate service, and store full responses locally. Only use it in a controlled environment with trusted environment variables and avoid sharing sensitive product-research queries or credentials through agent logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:262
Finding: Automatic Transmission of User Feedback to an Unrelated External Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/jiimore_get_niche_info_by_keyword.py:35
Finding: Credential-Bearing Requests Can Be Redirected to Arbitrary Endpoints
Content: View full analysis
str: return ( os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com" ).rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding exposes additional unrestricted endpoint overrides: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com", ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Authenticated onboarding requests attach the access token directly: ```python if access_token: h["authorization"] = access_token h["uid"] = ( _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ) ``` ### Technical Analysis The scripts allow environment variables to replace official service hosts ...[truncated 1551 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/jiimore_get_niche_info_by_keyword.py:60
Finding: Unnecessary Agent Session and Message Metadata Is Sent to the Gateway
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onboarding.py:483
Finding: Generated API Key Is Printed to Standard Output and Stored in Plaintext Shell Profiles
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} Successfully obtained API key " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` The onboarding instructions direct users to persist the returned secret through commands equivalent to: ```shell setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login command returns the complete API key in a JSON object and prints that object to stdout. In Agent-operated environments, stdout may be retained in tool transcripts, chat history, terminal logs, CI logs, redirected files, or monitoring systems. The onboarding guide then recommends placing the key directly in persistent shell startup files. These files are plaintext and may be exposed through backups, support bundles, dotfile repositories, extensions, or other local accounts and processes with read access. ### Attack Path 1. The user supplies a phone number and SMS verification code. 2. The onboarding flow generates or retrieves an API key. 3. `_emit()` prints the complete API key to stdout. 4. T ...[truncated 638 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/jiimore_get_niche_info_by_keyword.py:247
Finding: Unsanitized Session Identifier Allows Output Path Traversal
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script contains an equivalent construction: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is inserted into a filesystem path without validation. Values containing parent-directory components can escape the expected date directory. On platforms where `os.path.join` accepts an absolute component as path replacement, an absolute session identifier can also discard the intended prefix. The scripts subsequently create directories and write response files, metadata, index entries, or payment QR images beneath the resulting location. Exploitation requires control over the process environment, ...[truncated 1029 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/onboarding.py:162
Finding: Onboarding Recommends Unpinned Runtime Dependency Installation
Content: View full analysis
dict: try: import qrcode except ImportError: err = "Missing dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return { "png_path": None, "ascii_qr": None, "error": err, } ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing dependency; run: pip install requests" ) ``` ### Technical Analysis The onboarding script instructs users to install mutable package names without: - Exact version constraints. - Artifact hashes. - A lockfile. - A controlled package index. - An isolated environment. The package names are common and are not themselves evidence of malicious dependencies. However, resolving unrestricted latest versions from the user's configured index creates avoidable supply-chain exposure. ### Attack Path 1. The user invokes onboarding on a system where a dependency is missing. 2. The script directs the user to run an unpinned `pip install` command. 3. Pip resolves packages and transitive dependencies from the configured package index. 4. A compromised index configuration, package release, or transitive dependency supplies malicious code. 5. The code executes during installation or when imported by onboarding. ### Impact Assessment A malicious dependency executes with the privileges of the user running pip or the Skill. It could access environment variables, including LinkFox API credentials, read local files, or alter the Python environment. The practical likelihood is lower than the credential-handling findings because exploitation depends on an upstream package or package-index compro ...[truncated 9 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (25)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The outbound request includes multiple headers populated directly from environment variables, and the destination base URL is also environment-controlled via LINKFOX_TOOL_GATEWAY. In an agent/runtime context where environment values may be attacker-influenced, this enables exfiltration of sensitive execution metadata and potentially the API key to an arbitrary endpoint by redirecting the request target.
Content: Scanner excerpt · scripts/jiimore_get_niche_info_by_keyword.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: The code allows network destinations to be controlled by environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints via requests.post. In a skill/runtime environment where env vars can be influenced, this becomes an SSRF and credential-exfiltration path, and the danger is amplified because this skill already handles high-value authentication material unrelated to its declared niche-analysis purpose.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 92% confidence
Finding: The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header carrying the API key. An attacker who can alter the environment can redirect these calls to a malicious or internal host, causing API-key leakage or unauthorized network access, which is especially risky in an agent skill that may run in shared or automated environments.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose is keyword-based niche analysis, but the skill behavior reportedly includes SMS verification, phone-based login, API-key generation, team/account inspection, plan listing, order creation, QR-code payment generation, and payment-status checks. That is a major privilege and purpose expansion into authentication, account management, and billing flows, which can be abused for unauthorized account actions or social-engineering-assisted purchases.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation criteria are overly broad and can trigger on generic market-research or opportunity-assessment requests, even when the user did not ask for this specific tool. In context, that is dangerous because the skill can incur paid API usage, write persistent local logs, and invoke unrelated onboarding/payment behaviors under an expansive trigger surface.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
}

text
## Display Rules 1. **Present data clearly**: Show query results in well-structured tables. Convert decimal ratios to percentages for readability (e.g., 0.25 -> 25%). 2. **Highlight key metrics**: Always surface the niche title, demand score, weekly search volume, weekly sales, brand count, and top 5 brands click share as primary columns.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements account onboarding, SMS login, API-key acquisition, plan listing, ordering, and payment QR generation, which does not match the declared skill purpose of Amazon niche keyword analysis. This functionality mismatch is dangerous because it creates a covert credential-collection and commerce workflow under the cover of an unrelated analytical skill, increasing the likelihood of deceptive data capture.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The package and order management logic introduces commerce capabilities that are unnecessary for a keyword-market-analysis skill and can induce users to make purchases through the agent. In context, this is more dangerous because it monetizes an undeclared workflow and pairs purchasing with account/API-key handling, expanding both fraud and abuse potential.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section performs SMS verification, login, token exchange, user/team discovery, and API-token generation, all unrelated to the stated niche-analysis functionality. Because it directly obtains and returns long-lived credentials, a misleading skill context makes this significantly more dangerous: users may provide phone numbers and codes without realizing the skill is provisioning access and exposing tokens.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises capabilities that imply access to environment variables, local file writing, and network calls, yet it declares no explicit tool scope or permission boundary. This creates an authorization ambiguity where a user or host system may not realize the skill can access secrets, persist data, or contact external services, increasing the risk of unintended data exposure or over-privileged execution.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires saving every full API response to a session-linked local path under the working directory by default. Persistent logging of complete responses can leak sensitive user queries, business research, account-related API content, or identifiers to other local processes, collaborators, backups, or source-control mistakes, and the session-based path makes cross-task correlation easier.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file instructs the skill to translate user-provided keywords into English, Japanese, or German based on marketplace before calling the API. This imposes a language transformation automatically rather than offering the user a choice or obtaining opt-in, which is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs automatic reporting to a separate Feedback API unrelated to the core niche-analysis function. Silent side-channel reporting can transmit user prompts, outputs, or metadata to an additional service without clear consent, expanding data sharing beyond the user's expectation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 203)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/jiimore/getNicheInfoByKeyword \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes a skill for analyzing Amazon niche markets by keyword, but this file also documents a distinct endpoint for posting user feedback to skill-api.linkfox.com. Collecting and transmitting feedback is not an obvious requirement of keyword-based niche analysis and introduces an additional outbound capability outside the core analytical purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The onboarding flow explicitly instructs collection and handling of a user's phone number and one-time verification code, which are sensitive authentication factors, without any privacy notice, minimization guidance, or warning not to retain or reuse them. In an agent context, this increases the risk of credential interception, account takeover, and unsafe handling of personal data if the agent or logs capture these values.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file header promises outputs are written only under the current working directory and explicitly says writing to /tmp is forbidden, but the implementation falls back to the home directory and then the temp directory. In agent environments, this can cause data to be written outside the expected project boundary, increasing the risk of unintended data exposure, cross-task leakage, or persistence in less controlled locations.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Natural-language strings and validation logic enforce an 11-digit domestic phone number with +86, and the ordering flow is limited to wechat and alipay. For a general onboarding CLI, this constitutes a locale policy concern because the file does not offer user opt-in to a China-specific locale or clearly document that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The login flow returns a freshly obtained API key in stdout JSON, which is likely to be captured by agent logs, transcripts, shell history, orchestration systems, or downstream tools. Since the code is part of a skill and not a local-only CLI with clear operator expectations, the surrounding context makes credential exposure substantially more dangerous.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file contains user-facing API instructions in Chinese from the title onward, but it does not indicate that the skill is region-specific or provide an opt-in language choice. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s primary natural-language documentation, usage notes, and output policy are written in Chinese, and later runtime messages such as the API key error are also Chinese-only. This imposes a specific language/locale on users without any indication of choice or justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment says responses below the threshold are 'directly fully output, not written to file', but main() always resolves an output path and writes the serialized response to disk before deciding whether to print inline. This is an active contradiction between documentation and behavior, not just omitted detail.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The path-selection logic explicitly allows falling back to $TMPDIR even though earlier documentation says /tmp must not be used. For a skill that may process market-analysis data tied to user sessions and metadata, writing to temp locations can expose data to weaker retention and isolation guarantees and may violate user or platform expectations.
Content: No source excerpt is available for this finding.