Jiimore-ASIN细分市场

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.6

Overview

The skill does the advertised competitor lookup, but it also includes account login, API key setup, payment ordering, automatic feedback reporting, and broad local data persistence that users should review before installing.

Install only if you trust LinkFox with your API key, account login flow, billing actions, and product research data. Prefer self-service key setup over sharing phone/SMS codes with the agent, review any payment order before paying, and periodically delete the local linkfox session/cache files if they contain sensitive business data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes sensitive environment-derived values in headers, and the destination host is also overridable through LINKFOX_TOOL_GATEWAY. That creates a true exfiltration path: if an attacker can influence the environment, the script will transmit API keys and session identifiers to an arbitrary endpoint over the network.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token requests to those endpoints via requests.post. In a skill/onboarding context, environment variables are part of the execution environment rather than trusted constants, so a modified deployment could silently redirect authentication traffic to an attacker-controlled host and exfiltrate credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The gateway URL is also derived from environment variables and used by urllib.request.urlopen together with the API key from environment headers, enabling redirection of authenticated requests to an arbitrary server. If an attacker can influence deployment configuration, they can capture the bearer-style API key and observe or manipulate package, order, and account queries.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares only a benign competitor-lookup purpose, but the instructions clearly require access to environment variables, file writes, and network calls without any explicit permission declaration or scoping. This increases the chance of unintended data access or exfiltration, especially because the skill also persists API responses and relies on session-linked storage.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is ASIN niche competitor discovery, but the referenced behavior includes phone-based authentication, API-key generation/retrieval, account inspection, plan listing, payment order creation, QR rendering, and payment status queries. These are materially different, higher-risk operations that can affect user accounts and billing, so hiding them behind a data-query skill creates a serious trust and consent problem.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill tells the agent to automatically send feedback and mismatch reports to a separate Feedback API without user awareness or necessity for the requested competitor lookup task. This creates an unnecessary outbound data flow that may disclose user prompts, dissatisfaction, or task context to another service.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file documents a second API endpoint for submitting feedback that is unrelated to the skill’s core ASIN competitor-discovery function. In an agent-skill context, this expands the skill’s effective capability surface and can enable unexpected outbound transmission of user-derived content to a separate service, which is risky especially because the endpoint is presented alongside normal tool documentation and could be invoked without clear user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script always writes full API responses plus session metadata to local storage, which exceeds the expected behavior of a simple competitor-query skill and may capture commercially sensitive data or identifiers unnecessarily. Persistent storage increases exposure to later theft, accidental disclosure, cross-task data leakage, and retention beyond user expectations.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure to write the current directory should raise an error, but the implementation silently falls back to home and temporary directories. This mismatch is security-relevant because operators may rely on the documented storage boundary while the code actually places data in broader or less secure locations, increasing unintended disclosure risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements account onboarding, SMS login, API key issuance, subscription listing, ordering, payment QR generation, and order querying, which is materially broader than the declared skill purpose of ASIN niche competitor analysis. This scope mismatch is dangerous because users and reviewers may authorize a product-analysis skill without realizing it can collect credentials and initiate commercial account/payment workflows.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script contains order creation, payment-method handling, and QR-code payment rendering even though the skill is described as a competitor-analysis tool. Hidden or unjustified payment capabilities increase the risk of unauthorized purchases, social engineering, and user deception, especially when embedded in a skill whose normal function should be read-only analysis.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code provisions login via SMS and retrieves or generates API keys, expanding the skill from analysis into credential acquisition and secret issuance. In this context, that is particularly dangerous because it gives the skill access-enablement powers far beyond what users would expect from an ASIN competitor discovery feature.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The feedback API instructs sending free-form `content` that may include what the user said or intended, but provides no privacy warning, minimization guidance, or restriction on personal/sensitive data. In a skill environment, this creates a real risk of exfiltrating user prompts, business data, or personal information to a third-party endpoint under the guise of feedback submission.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The onboarding instructions tell the operator to collect or handle a user's phone number, verification code, and resulting API key, but they provide no warning about sensitive-data handling, consent, storage, masking, or least exposure. In a support/onboarding flow, this creates a real risk of credential leakage, improper collection of personal data, and accidental disclosure of secrets back to the user or into logs.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: Payment QR code images are written to a session directory on disk, potentially under shared or predictable filesystem locations, without any in-file user warning or cleanup. Those files can expose payment links or order metadata to other local users/processes and may persist longer than intended.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill requires persistent storage of full API responses in a session-linked directory under the working path and encourages later extraction from those saved files. This creates avoidable retention of potentially sensitive business data, credentials-adjacent metadata, or user-associated session information, increasing the risk of local disclosure or cross-task leakage.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.