ClawHub
Back to skill

Security audit

Jiimore-细分市场信息

Security checks across malware telemetry and agentic risk

Overview

The skill is a real market-data tool, but it also handles account login, API-key creation, billing orders, payment QR codes, and persistent local storage in ways users should review carefully.

Install only if you are comfortable with LinkFox handling your Jiimore requests, API key, possible phone/SMS onboarding data, and payment-related actions. Use the self-service website for account and billing steps when possible, verify any payment URL or QR code independently, and be aware that full API responses and QR images may remain on disk under linkfox directories, including fallback locations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
91% confidence
Finding
The request sent via urlopen includes environment-derived values such as SESSION_ID, MODE_ID, APP_NAME, and an API key, and the destination base URL is also overrideable through LINKFOX_TOOL_GATEWAY. That creates a real exfiltration path: if the environment is influenced by an attacker or an untrusted runtime, sensitive metadata and credentials can be transmitted to an attacker-controlled endpoint.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and authorization headers to those endpoints with requests.post. In a skill environment, environment variables are part of the trust boundary; if an attacker or misconfigured host overrides the API base URLs, the skill can exfiltrate credentials and onboarding data to an attacker-controlled server.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
The gateway helper composes a URL from environment-derived base paths and uses urlopen with the API key in the Authorization header. If the base URL is redirected via environment manipulation, the skill will transmit the LinkFox API key and subsequent account/order operations to an attacker-controlled endpoint, enabling credential theft and misuse.

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares no permissions, yet its documented behavior includes reading environment variables, writing files to the working directory, and making network/API calls. This creates a transparency and governance gap: reviewers and users cannot accurately assess what the skill can access or modify, increasing the chance of unsafe deployment or misuse.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a niche-market lookup tool, but the detected behavior includes SMS login, API key retrieval/generation, subscription plan listing, payment order creation, QR-code payment generation, and payment-status polling. Mixing commerce/authentication flows into an analytics skill can expose users to credential handling, billing actions, and unexpected external interactions beyond their consent.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The document embeds authentication recovery, account registration, and billing workflows inside a skill whose declared purpose is niche-market analytics. This scope expansion is dangerous because it encourages the agent to handle credentials, account lifecycle actions, and payment-adjacent flows that are unrelated to the core function, increasing attack surface and the chance of social-engineering or unauthorized account actions.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill instructs collecting a user's phone number and using a script to send verification codes and log in, which exceeds the stated analytics purpose and enables account provisioning or takeover-style flows. Even if intended for convenience, this creates a sensitive identity and authentication handling path that could be abused to register accounts without sufficient user understanding or controls.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The documented plan listing, order creation, payment-method selection, and payment status querying introduce a billing workflow unrelated to niche analytics. Payment-adjacent actions are especially sensitive because they can pressure users into transactions, expose order identifiers, and create opportunities for phishing, fraud, or unauthorized purchases through the agent.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The script persistently stores full API responses and session metadata under local linkfox directories, which exceeds the apparent read-only market-insights behavior described by the skill metadata. This can expose potentially sensitive market data, session identifiers, and usage traces to other local users, later tools, or unintended retention processes.

Intent-Code Divergence

High
Confidence
94% confidence
Finding
The docstring promises not to write to /tmp and to fail if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This mismatch is dangerous because operators may rely on the documented storage boundary while the code actually persists data in less controlled locations, increasing the chance of sensitive data leakage.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This file implements LinkFox account onboarding, SMS verification, API key retrieval, package listing, ordering, and payment QR generation, which is materially different from the declared niche-market-insights purpose. That mismatch increases risk because users invoking a market-intelligence skill would not reasonably expect account provisioning and billing flows, creating strong potential for deceptive credential collection and unauthorized purchases.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill contains order creation, plan selection, and payment QR code generation despite being described as a market-insights query tool. Embedding billing capability in an unrelated skill is dangerous because it can trigger purchases under misleading context and exposes users to financial harm if the skill is abused or misunderstood.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code performs SMS-based authentication, obtains access and refresh tokens, queries team membership, and generates API tokens, none of which are justified by a market-insights lookup skill. In this context, collecting login codes and minting long-lived API credentials is especially risky because it can silently expand access well beyond the user's expected task.

Vague Triggers

High
Confidence
87% confidence
Finding
The trigger list contains generic phrases such as market insights, competition analysis, price trends, and growth trends, which commonly appear in many unrelated research tasks. This overlap increases the risk of accidental routing to this skill, potentially causing unnecessary paid API calls, irrelevant outputs, or disclosure of user inputs to third-party services.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list contains generic phrases such as market insights, competition analysis, price trends, and growth trends, which commonly appear in many unrelated research tasks. This overlap increases the risk of accidental routing to this skill, potentially causing unnecessary paid API calls, irrelevant outputs, or disclosure of user inputs to third-party services.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The instructions tell the operator to ask for a user's phone number and use it in a scripted registration/login process, but provide no privacy notice, consent language, storage limitation, or handling guidance. This is dangerous because phone numbers and verification flows are sensitive personal/authentication data, and collecting them without explicit safeguards increases privacy and abuse risk.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The script transmits user-supplied parameters together with session/app metadata to a remote service without any explicit consent or warning at the execution boundary. In this skill context, users may assume they are only invoking a local market-analysis helper, so silent transmission of identifiers and business data increases privacy and data-governance risk.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The script caches and stores full API responses on disk without a clear warning about local retention. Even if the data is business-oriented rather than obviously secret, retained responses can still contain proprietary insights, account-linked information, or identifiers that remain accessible after the task completes.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The QR renderer writes payment QR images to disk in a session directory without an in-file disclosure to the user about local artifact creation or retention. On shared systems, these files may persist and be accessed later, exposing payment links or transaction metadata beyond the immediate session.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
90% confidence
Finding
This code transmits user and credential data to external services over the network. External transmission is particularly sensitive here because the same module handles SMS login, tokens, and account data, so any misrouting or abuse could leak highly sensitive information.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.