Jiimore-细分市场评论

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.6

Overview

The skill can perform the advertised review lookup, but it also handles login, API keys, payments, local storage, and automatic feedback reporting in ways users should review before installing.

Install only if you are comfortable with a paid LinkFox integration that may ask for phone/SMS login, produce and display API keys, create payment orders, write full API responses locally, and send feedback to a separate LinkFox endpoint. Prefer self-service account setup, avoid sharing one-time codes in chat when possible, store API keys in a secret manager rather than shell profiles, and do not set LinkFox endpoint override environment variables unless you fully trust the destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sends environment-derived values, including API credentials and session/application identifiers, to a remote endpoint whose base URL can itself be overridden by the LINKFOX_TOOL_GATEWAY environment variable. This creates a real exfiltration path: in a hostile or manipulated runtime, secrets and metadata can be transmitted to an attacker-controlled service over the network.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, so a hostile runtime can redirect login and token-bearing requests to an attacker-controlled server. Because these requests carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this becomes credential exfiltration and SSRF-by-configuration rather than a harmless configuration feature.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request URL is also built from environment-controlled base configuration and then invoked with Authorization headers containing the API key. An attacker who can influence environment variables can force authenticated requests to arbitrary hosts, exposing secrets and enabling unintended outbound requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill uses sensitive capabilities—environment access, file writes, and network calls—without any declared permission boundary or user-facing scoping. That creates an execution-trust gap: a reviewer or runtime may assume the skill is limited to review analysis, while it can also access secrets and persist or transmit data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is niche review analysis, but the behavior reportedly extends into account login, SMS verification, API key acquisition, subscription lookup, order creation, payment QR generation, and payment-status polling. This is a significant scope expansion into authentication and billing flows, which can expose users to credential handling, unintended purchases, and collection of sensitive account/payment data unrelated to the stated task.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file documents a separate external Feedback API that is unrelated to the stated niche-review retrieval purpose of this skill. In an agent context, extra documented capabilities can expand the effective action surface and may cause the agent to send user-derived content to an additional endpoint without clear user intent, creating unnecessary data exfiltration and scope-creep risk.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script persistently stores the full API response to disk regardless of size, even though the skill is framed as analysis/insight rather than archival export. If the response contains customer review data, identifiers, account metadata, or other sensitive fields, this increases local data exposure and retention risk beyond what is necessary for the task.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The docstring says writing to /tmp is forbidden, but the implementation explicitly falls back to tempfile.gettempdir(). This mismatch is dangerous because operators may rely on the documented guarantee while the code actually writes sensitive API output into a commonly accessible temporary location.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The comment states that small responses are printed directly without file output, but the code still writes them to disk first. This is a security-relevant behavior mismatch because users and reviewers may assume ephemeral handling when the script is actually persisting all returned data.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS authentication, API-key retrieval, subscription purchase, and payment QR generation, which is fundamentally unrelated to the declared niche-review analysis purpose. This mismatch is dangerous because it creates a deceptive skill that can solicit credentials, tokens, and payments under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code fetches or generates API tokens for a group and returns them to the caller, granting reusable access credentials beyond the immediate task. In the context of a review-analysis skill, issuing platform API keys is unjustified and materially increases the chance of secret theft and downstream account compromise.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Sending SMS verification codes and performing phone-based login is outside the expected behavior of a review-analysis tool and collects sensitive authentication factors from users. In a mismatched skill, this is especially risky because it normalizes phishing-like flows and expands the attack surface for account takeover.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to auto-activate even when the user did not explicitly request niche-review analysis. Overbroad triggering increases the chance the skill will run in unintended contexts, causing unnecessary external calls, cost-incurring actions, or disclosure of user inputs to third-party services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs operators to collect and handle a user's phone number and one-time verification code through a script, but provides no warning that these are sensitive authentication factors or guidance on minimizing exposure. This creates a real risk of credential interception, insecure handling, and account takeover if the data is logged, retained, or mishandled during support flows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions tell users to persist an API key in shell profile files and environment variables without warning that the key is a secret or that profile files may be readable by other local users, backups, terminal history, or support tooling. Persisting long-lived credentials this way increases the chance of local secret disclosure and unauthorized API use.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script always writes the full API response to disk and only emits a generic save message, without warning that potentially sensitive remote data is being persisted locally. This weakens informed consent and increases the chance of accidental retention of data that users expected to remain transient.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code forwards SESSION_ID, MODE_ID, and APP_NAME from the environment to the remote service without any user-visible disclosure or minimization. While these may be operational fields, they can still leak internal workflow and tracking metadata to external infrastructure, especially combined with a configurable gateway endpoint.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The CLI prints newly obtained API keys directly to stdout JSON, where they may be captured by logs, transcripts, shell history, agent tooling, or other components. Exposing reusable credentials in normal output significantly increases the likelihood of accidental disclosure and unauthorized reuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: External transmission alone is not inherently vulnerable, but here it is security-relevant because the request may carry authentication and account data to endpoints that can be environment-overridden. In combination with the endpoint override behavior, this is a meaningful data-exfiltration risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.