Jiimore-细分市场评论

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.7

Overview

The skill can perform the advertised review analysis, but it also handles login, billing, persistent storage, and automatic feedback reporting with too little scoping for silent installation.

Review this skill carefully before installing. Use it only if you accept LinkFox/Jiimore network calls, paid-credit usage, local response files, assisted phone/SMS onboarding, and payment flows. Avoid entering OTPs in chat where possible, do not store API keys in shell startup files, and do not set LINKFOX_* endpoint override variables unless you fully trust the destination.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:243

Finding

Silent Disclosure of User Statements and Intent Through the Feedback API

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:68

Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Environment-Controlled Endpoints

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "Accept": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` ```python def _env_base(name: str, default: str, *fallbacks: str) -> str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() ``` ```python def _f ...[truncated 3013 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jiimore_get_niche_review.py:61

Finding

Unnecessary Agent Session and Message Identifiers Are Sent with API Requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/onboarding.md:11

Finding

Onboarding Instructions Persist API Keys in Plaintext Shell Configuration

Content

View full analysis

"` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` - Variable name: `LINKFOX_AGENT_API_KEY` or `LINKFOXAGENT_API_KEY` ``` ### Technical Analysis The onboarding guide recommends permanently writing a bearer-style API key into shell startup configuration or the user's persistent environment. Shell startup files are plaintext and are frequently included in workstation backups, dotfile repositories, diagnostic archives, and migration bundles. Their permissions and access controls may also be weaker than those of a dedicated credential store. Commands containing the substituted key can additionally remain in shell history. Persistent environment variables may be inherited by unrelated child processes, expanding the number of processes capable of reading the credential. ### Attack Path 1. The user completes SMS onboarding and receives an API key. 2. The user follows the documented command and substitutes the real key. 3. The key is written to a plaintext shell startup file or persistent user environment. 4. Another local process, user, backup service, support bundle, or accidentally published dotfile repository obtains the key. 5. The exposed key is used to consume paid API credits or access services authorized by the token. ### Impact Assessment An attacker obtaining the key can act within the API key's remote authorization scope and consume the user's paid credits. The key may remain exposed across sessions until it is manually removed and rotated. This does not create a scheduled task or service, but it does create avoidable cross-session credential persistence. ...[truncated 4 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Runtime Installation Guidance Uses Unpinned Third-Party Dependencies

Content

View full analysis

None: if requests is None: raise RuntimeError("pip install requests") ``` ### Technical Analysis The onboarding script directs users to install `qrcode`, `pillow`, and `requests` without version constraints, hashes, a lockfile, or a specified trusted package index. This allows dependency resolution to vary over time and gives newly published or compromised releases an opportunity to execute during installation or import. The `requests` package participates directly in login and token-bearing network operations. A compromised dependency would execute with the user's local privileges and could access process environment variables, authentication tokens, phone numbers, SMS codes, and API keys. No evidence shows that the named packages are currently malicious. The issue is the unsafe and non-reproducible installation method. ### Attack Path 1. A required package is unavailable in the current environment. 2. The script displays an unpinned `pip install` instruction. 3. The user runs the command against their configured package index. 4. A compromised, malicious, or unexpectedly changed package version is installed. 5. Package installation hooks or imported code execute with the user's privileges. 6. Malicious code reads environment credentials or intercepts the onboarding authentication flow. ### Impact Assessment A compromised dependency can execute arbitrary code under the invoking user's account. It could read files accessible to that account, steal LinkFox credentials and onboarding tokens, alter net ...[truncated 172 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tainted flow: 'req' from os.environ.get (line 74, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/jiimore_get_niche_review.py (reported line 81)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code allows network destinations to be overridden by environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs. In a hostile or multi-tenant execution environment, an attacker who can influence environment variables can redirect authentication traffic and exfiltrate credentials or tokens to attacker-controlled infrastructure.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway URL is derived from environment variables and used to construct urllib requests carrying the Authorization API key to the remote server. If the runtime environment is attacker-influenced, requests can be redirected to a malicious host and the API key, order operations, and account metadata can be exposed or abused.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared skill purpose is niche review analysis, but the behavior summary indicates hidden support for SMS login, account access, API key generation, subscription/package lookup, payment initiation, QR-code generation, payment-status polling, and local file writes. That is a major scope expansion into identity, billing, and persistence operations, which could expose users to unauthorized account actions, charges, or credential handling under the guise of analytics.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

text

Parameters: `{"keyword": "water bottle", "returnRateT360Max": 0.05}`

## Display Rules

1. **Present data clearly**: Show review topics in a well-organized table. Include the niche name, review type (positive/negative), topic, mention percentage, and a review example
2. **Percentage formatting**: Convert 0-1 scale values to percentages for display (e.g., 0.15 -> 15%)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring promises that writing to /tmp is forbidden and that failure should occur if the current directory is not writable, but the implementation silently falls back to the home directory and then a temporary directory. This mismatch is dangerous because operators may rely on the documented storage guarantees when handling potentially sensitive API responses, yet the code can place those responses into less controlled locations such as shared temp space.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is described as Amazon niche review and sentiment analysis, but the file implements account onboarding, SMS authentication, API-key retrieval, package listing, ordering, and payment QR rendering. This scope mismatch is dangerous because it collects credentials and enables account and billing actions unrelated to the declared purpose, which materially increases the chance of covert credential harvesting or unauthorized commerce flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Billing and order-creation logic is embedded in a skill that should only analyze reviews, including package selection, order submission, and payment QR code generation. In context, this makes the skill more dangerous because users invoking analytics functionality would not reasonably expect purchase capabilities, creating risk of unauthorized charges or dark-pattern commerce behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code performs SMS login, obtains access and refresh tokens, queries user/team information, and retrieves or generates API tokens, none of which are necessary for sentiment analysis. In this skill context, collecting authentication factors and minting long-lived credentials is especially risky because it can enable account takeover, token theft, and privilege expansion under the guise of an unrelated analytics workflow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though the manifest instructs use of environment variables, network access, and filesystem writes. This creates unnecessary privilege ambiguity: an agent may invoke capabilities broader than users expect, making accidental data access, persistence, or exfiltration more likely.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill requires always writing full API responses to a session-scoped project directory and forbids ephemeral storage. Persisting complete responses by default can retain user queries, market data, identifiers, or other sensitive content longer than needed, increasing exposure to other tools, collaborators, or later tasks in the same workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown states that the keyword 'Must be in the language of the target marketplace (English for US, German for DE, Japanese for JP)'. This imposes a strict locale requirement rather than offering a choice or fallback behavior, and the file does not present it as an opt-in regional constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Although marketed as review sentiment analysis, the parameter surface exposes extensive market-intelligence and commercial analytics fields such as sales, conversion, price, competition, concentration, returns, launches, and CPC. This mismatch can cause users and downstream policy systems to underestimate the breadth of data processing and decisions being made, increasing the risk of unintended use of broader analytics capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says some market-research tasks are out of scope, yet its examples and supported filters enable those same workflows. Contradictory boundaries are dangerous because they defeat user understanding and enforcement logic, allowing the agent to perform broader analysis than the user or platform may have authorized.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs automatic reporting of user dissatisfaction, praise, mismatch observations, or any perceived improvement opportunities to a Feedback API without explicit user consent or minimization. That can transmit interaction-derived data beyond the immediate task context, creating privacy and trust risks and potentially leaking sensitive business intent or user sentiment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 161)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/jiimore/getNicheReviewFromKeyword \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file for a niche review analysis skill embeds a separate Feedback API that sends data to a different external service and is unrelated to the core tool endpoint. This increases the chance an agent will exfiltrate user content or conversation summaries to another destination without clear user expectation or functional necessity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Feedback API invites transmission of free-form content describing user statements and outcomes to an external public endpoint, but the documentation provides no warning, consent requirement, or minimization guidance. That can lead an agent to send sensitive user text, business data, or conversation context off-platform without authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to collect a user's phone number and then handle SMS-based registration/login through a local script, but it provides no privacy, consent, storage, or minimization guidance for this sensitive personal data. This creates a real risk of unnecessary collection, exposure in logs/transcripts, and account takeover implications if the phone number and one-time code are mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends session-related environment values such as SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME as HTTP headers without prominent user disclosure or minimization. These values can expose internal identifiers, workflow metadata, or correlation handles to the remote service, increasing privacy and traceability risk beyond the apparent purpose of review analysis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script persists complete API responses and session metadata to disk by default, which exceeds the narrow expectation of transient review analysis and creates a local data-retention surface. If responses contain sensitive business data, user prompts, or proprietary review intelligence, they may remain accessible to other local users, backup systems, or later processes without the user's clear awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes full API responses to disk by default and may silently fall back to home or temporary directories, broadening exposure of collected data. In the context of a review-analysis skill, users would reasonably expect API processing, not automatic multi-location persistence of complete results that may contain commercially sensitive analytics or identifiers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and CLI help text are entirely in Chinese, and the workflow is explicitly tied to domestic phone numbers and China-specific payment/area code conventions. The file does not offer any language or locale choice or document this as a justified region-specific constraint, which conflicts with the policy against forcing a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill creates local session directories and writes payment QR images to disk even though its stated purpose is analytics. This expands data persistence and artifact leakage risk, especially on shared hosts where saved QR codes, session identifiers, or associated payment data may be exposed to other users or processes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.