Security audit

Jiimore-细分市场信息

Security checks for vulnerabilities and agentic risk

Overview

This market-data skill needs review because it adds silent feedback reporting, broad local storage, and account/payment handling beyond a simple niche lookup.

Review carefully before installing. Use only if you are comfortable sending niche IDs and related market context to LinkFox/Jiimore, avoid the automatic feedback path unless explicit consent and redaction are added, do not enter phone/OTP credentials through the skill unless you trust the provider, and prefer a secure secret store over printing or saving API keys in shell startup files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:162
Finding: Silent Disclosure of User Statements and Intent to an External Feedback Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/jiimore_get_niche_info.py:36
Finding: Authentication Credentials Can Be Redirected to Arbitrary Environment-Controlled Hosts
Content: View full analysis
str: """网关基础地址：env LINKFOX_TOOL_GATEWAY 优先，缺省回退正式地址。""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` The onboarding endpoints are also environment-controlled: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive tokens are sent through those configurable endpoints: ```python def _login_by_token(access_token: str, refresh_token: str) -> dict: """新用户送算力。失败不阻断。""" resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-li ...[truncated 2176 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/jiimore_get_niche_info.py:250
Finding: Unsanitized SESSION_ID Enables Writes Outside the Intended Storage Directory
Content: View full analysis
str: """优先 env SESSION_ID；缺省按 HHMMSS-<6 hex> 生成（同一进程内稳定）。""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] ``` ```python def _ensure_session(ts: float) -> tuple[str, str]: """返回 (linkfox_root, session_dir)；session_dir 一定存在。""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` ```python out_path = _resolve_output_path(ts) try: with open(out_path, "w") as f: f.write(serialized) ``` The onboarding script uses the same unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is used directly as a filesystem path component. The code does not reject: - Absolute paths. - `..` traversal components. - Forward or backward path separators. - Platform-specific drive or UNC paths. - Existing symlinked path components. With `os.path.join`, an absolute final component can discard preceding components. Traversal components can a ...[truncated 1405 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:486
Finding: Generated API Keys Are Printed to Standard Output and Recommended for Plaintext Persistence
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboarding instructions recommend persistent plaintext shell configuration: ```text setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The login command includes the complete generated API key in JSON written to stdout. Standard output is frequently retained in Agent transcripts, terminal logs, CI logs, shell pipelines, command-capture systems, and parent-process buffers. The suggested setup commands additionally expose the key through command history and persist it in plaintext shell startup files. Those files may be readable by backup tools, debugging utilities, local processes, or other users when permissions are weak. The API key is a reusable credential rather than a one-time value, increasing the impact of accidental retention. ### Attack Path 1. The user supplies a phone number and SMS verification code to onboarding. 2. The script obtains or generates an API key. 3. `_cmd_login` serializes the complete key to stdout. ...[truncated 703 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/onboarding.py:163
Finding: Runtime Instructions Install Unpinned Third-Party Dependencies
Content: View full analysis
dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The script directs users to install `qrcode`, `pillow`, and `requests` without specifying reviewed versions, integrity hashes, a lock file, or an approved package index. The exact code installed therefore depends on mutable external package-index state and local pip configuration. A compromised index, dependency confusion condition, account takeover of a package publisher, or maliciously configured mirror could introduce attacker-controlled code. Python packages may execute code during installation and are imported into the onboarding process, which handles authentication tokens and payment data. ### Attack Path 1. The required import fails. 2. The script instructs the user to run the unpinned `pip install` command. 3. Pip resolves package versions from the user's configured indexes and mirrors. 4. A compromised, substituted, or unexpectedly changed package is installed. 5. Package code executes during installation or import. 6. The malicious dependency gains the privileges of the user running onboarding and may access its environment, tokens, files, and network. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the current user's operating-system permissions. It may read environment credentials, capture onboarding tokens, modify files, or estab ...[truncated 204 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/jiimore_get_niche_info.py:113
Finding: Complete API Responses Are Persisted with Unsafe Fallback Locations and Default Permissions
Content: View full analysis
/linkfox/...; writing to /tmp is forbidden, and a non-writable current directory must produce an error. ``` ### Technical Analysis The implementation persistently stores each response in both a 24-hour cache and a session output file. It does not explicitly set restrictive permissions on created directories or files, relying on the process umask. When preferred locations are unavailable, the script ...[truncated 1351 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: The request destination is derived from LINKFOX_TOOL_GATEWAY, an environment variable that can be influenced by the runtime environment, and the code attaches the API key plus SESSION_ID/MESSAGE_ID/MODE_ID/APP_NAME headers before sending the request. If an attacker can control that environment variable, they can redirect traffic to an attacker-controlled host and exfiltrate credentials and session metadata.
Content: Scanner excerpt · scripts/jiimore_get_niche_info.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 98% confidence
Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. In a skill environment, environment variables can be misconfigured or maliciously overridden, turning these flows into SSRF/exfiltration channels for credentials and account bootstrap data.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 98% confidence
Finding: The gateway client uses an environment-derived base URL and attaches the LinkFox API key in the Authorization header before calling urlopen. If an attacker can influence the environment, the skill will transmit the API key and subsequent account/order operations to an attacker-controlled endpoint, enabling credential theft and request replay.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is niche-market lookup, but the detected behavior includes authentication, API key generation, account/team queries, package listing, payment order creation, payment QR generation, and order status checks. This is a major capability mismatch that can surprise users and enable collection of credentials, account data, or payments outside the expected task scope.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
### Inventory & Operations - Average out-of-stock rate trends ## Display Rules 1. **Present data clearly**: Show query results in well-structured tables or grouped sections without subjective business advice unless specifically requested. 2. **Trend comparison**: When the response includes current, 90-day-ago, and 360-day-ago data points, present them side-by-side so users can easily spot trends.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements LinkFox account onboarding, SMS login, API key acquisition, plan listing, and order/payment flows, which materially diverge from the declared Jiimore niche-market insights purpose. This mismatch is dangerous because users or orchestration layers may invoke the skill expecting market analysis while instead being prompted into credentialing and commerce actions unrelated to the advertised function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code performs SMS-based login and returns credentials/API keys for LinkFox, which is unrelated to niche-market data analysis and unnecessarily collects highly sensitive authentication factors. In this skill context, the behavior is especially suspicious because it conditions users to provide phone numbers and one-time codes to a component that should only analyze market data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill can generate or retrieve API tokens and create paid orders, introducing account provisioning and commerce capabilities far beyond the stated market-insight use case. In context, this increases the likelihood of unauthorized account manipulation, unwanted charges, and covert monetization under the guise of analytics.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill uses sensitive capabilities like environment access, file writes, and network calls but does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it easier for the skill to access broader resources than users or the host system may expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation condition is broad enough to trigger on generic market-analysis requests even when the user did not explicitly ask for Jiimore or niche-ID-based lookup. That can cause unintended external data transmission, unnecessary paid calls, or the wrong skill handling a request, especially since the skill incurs cost and uses external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description does not clearly warn users that query parameters and related context will be sent to an external Jiimore service. This creates a transparency and privacy problem because users may unknowingly disclose business-sensitive IDs, market interests, or other data to a third party.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to always persist full API responses to a session-linked file path regardless of necessity. Full responses may contain user-provided identifiers, commercially sensitive market intelligence, or service metadata, creating avoidable local data retention and cross-session exposure risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 237)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/jiimore/getNicheInfo \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file documents a separate external Feedback API that sends free-form content containing what the user said or intended, what happened, and why. Without explicit privacy constraints, redaction guidance, or user-consent requirements, an agent could transmit sensitive user data, business context, or identifiers to a secondary service unrelated to the primary niche-info query.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The onboarding document adds authentication recovery, account registration, and billing/payment flows to a skill whose declared purpose is only niche-market insight retrieval. This capability mismatch is dangerous because it broadens the skill's authority into sensitive account and payment handling, increasing the chance of phishing, data collection, or misuse under the cover of an unrelated business function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs the agent to facilitate phone-based registration and plan purchase flows, which are unjustified for a market-insights skill and create an opportunity to collect personal data and steer users into payments. In context, this is more dangerous because users invoking a harmless analytics skill would not reasonably expect identity enrollment or checkout behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document directs collection of a user's phone number and one-time code through a script without any privacy notice, retention policy, or handling constraints. This is dangerous because phone numbers and OTPs are sensitive authentication data, and the absence of clear safeguards can enable overcollection, accidental logging, or account compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring promises not to write to /tmp and to fail if the current directory is not writable, but the implementation falls back to the home directory and then the temporary directory. This mismatch defeats operator expectations and can cause sensitive output to be stored in less trusted or more broadly accessible locations, including temp storage the documentation explicitly forbids.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is described as a query/analysis tool, but it persistently stores full API responses, cache entries, session indexes, and metadata on local disk. This creates unnecessary data-at-rest exposure, especially because market intelligence responses and session identifiers may contain sensitive or proprietary information beyond what the user expects from a read-style skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script always writes the full API response to disk, regardless of size, before deciding whether to print inline or summarize. Because this data may include sensitive business intelligence or user-correlated information, unconditional persistence increases privacy and exposure risk, especially in shared workspaces or retained project directories.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Natural-language strings and validation logic require an 11-digit domestic phone number and force the +86 area code, which imposes a specific locale on all users. The file does not present this as an explicit opt-in or clearly document that the tool is restricted to a China-specific user base.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The login flow emits a newly obtained API key in stdout JSON, which may be captured by logs, transcripts, calling agents, or downstream tooling not intended to handle long-lived secrets. Exposure of this token can allow unauthorized use of the linked account and any associated paid API capabilities.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file presents all operational instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.