Jiimore-商品发现

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:42 PM UTC
• Version: 1.0.6

Overview

The skill does product research, but it also includes account login, API-key creation, payment-order flows, automatic feedback reporting, and under-disclosed local storage behavior that users should review before installing.

Install only if you are comfortable with this skill using LinkFox network services, consuming paid credits, storing full result data locally, and assisting with LinkFox account or billing setup. Avoid entering phone/SMS codes or creating payment orders through the skill unless you intentionally want that flow, and treat any API key printed by the script as a secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent to urlopen includes headers populated directly from environment variables, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. In an agent/runtime context, this means secrets such as the API key and session metadata can be exfiltrated to an attacker-controlled endpoint if the environment is influenced or poisoned, making this a real tainted-data-to-network sink issue.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The code allows base URLs for login and agent-user requests to be overridden via environment variables and then sends sensitive data to those URLs with requests.post. That data includes phone numbers, SMS codes, access tokens, refresh tokens, and headers used for authentication, so a hostile or misconfigured runtime can redirect them to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the API key attached in the Authorization header. If an attacker can control the environment or skill configuration, they can redirect requests and capture the API key and account/order data, turning this into credential exfiltration and potentially SSRF-style behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill advertises and enables use of environment variables, network access, and file writes without any explicit permission declaration or user-facing consent boundary. This is risky because a seemingly simple product-research skill can access credentials and persist data locally, expanding the attack surface beyond what users would reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior significantly exceeds the declared purpose: in addition to product discovery, the skill appears capable of login flows, API key generation, package lookup, paid order creation, payment QR generation, and order-status polling. This mismatch is dangerous because users may invoke a market-research skill without realizing it can trigger authentication, billing, and account-linked operations against additional services.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documentation embeds a separate public feedback API that is unrelated to the core product-discovery function, creating an unexpected side-effect channel an agent could invoke. In an agent setting, this can cause unauthorized transmission of user content or interaction details to a third-party endpoint, which raises privacy, consent, and data-exfiltration concerns even if presented as a benign telemetry feature.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The onboarding document directs a product-discovery skill to handle authentication and billing failures through a bundled script, which materially expands the skill's operational scope beyond its advertised purpose. This creates an unexpected trust boundary: users invoking a market-research skill may be steered into account recovery, registration, and payment flows without clear separation or justification.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The documented behavior includes registration, API key acquisition, and plan purchasing, all of which are highly sensitive capabilities unrelated to product discovery. Combining commercial analysis with credential and payment onboarding increases the chance of phishing-like abuse, unauthorized data collection, and accidental exposure of secrets or billing actions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file broadens the skill from product discovery into auth troubleshooting and billing operations, violating the principle of least functionality. Such scope creep is dangerous because it conditions users to trust a non-support skill with account credentials, API key setup, and payment-related actions that could be abused or mishandled.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The module documentation explicitly says writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to other locations including the home and temp directories. This mismatch is security-relevant because operators and users may rely on the documented storage boundary and inadvertently expose sensitive API responses in less controlled locations.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code can write API response artifacts to fallback locations such as the user's home directory or temp directory, expanding the persistence surface beyond the stated workspace path. Because the responses may contain business-sensitive discovery data and session-linked metadata, writing into broader or shared locations can lead to unintended disclosure or weaker access control.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements SMS-based account onboarding, token exchange, API key generation, package listing, and payment operations, which are unrelated to the skill's declared Amazon product-discovery purpose. This capability mismatch is dangerous because it collects credentials and enables account and billing actions under the guise of a benign analytics skill, increasing the likelihood of deceptive data harvesting.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code can create orders and render payment QR codes even though the skill is described as a product-discovery tool, not a purchasing or subscription client. Embedding billing actions in an unrelated skill creates a strong risk of deceptive monetization, unauthorized charges, or coercing users into paying to use unrelated functionality.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This section performs SMS login, obtains access and refresh tokens, fetches user/team context, and generates or retrieves an API key, far beyond the stated product-selection scope. In context, that makes the skill much more dangerous because it is positioned to harvest reusable credentials and bootstrap persistent access to the user's LinkFox account.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger conditions are overly broad and can capture generic product-research or keyword-selection requests, causing the skill to activate in situations where the user did not intend to use this specific external service. In context, that matters because invocation may consume paid credits, send data to third-party APIs, and write responses to disk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill mandates writing full API responses to persistent files under the current project directory, but does not provide a prominent safety warning or clear data-minimization controls. This is dangerous because response data may include sensitive commercial data, identifiers, or account-related metadata that become unintentionally stored in repositories, shared workspaces, or backup systems.

Natural-Language Policy Violations

Medium

• Confidence: 79% confidence
• Finding: Requiring automatic translation of the user's keyword into the marketplace language without consent can silently alter the user's intended query and cause the system to send transformed user input to external translation or processing components. In a commerce-analysis skill this is less severe than direct code execution, but it still creates integrity and privacy risks because translated terms may misrepresent intent or disclose sensitive product ideas across additional services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions explicitly ask for a user's phone number and pass it to a registration script, but provide no privacy notice, retention policy, or warning about handling personally identifiable information. In the context of a product-discovery skill, this collection is unexpected and raises risk of privacy violations, misuse of personal data, or social-engineering abuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The login command emits the retrieved API key in stdout JSON, which is commonly captured by calling frameworks, logs, transcripts, shells, and agent tooling. This exposes a long-lived secret beyond its intended boundary and can enable account takeover or unauthorized API use if output is retained or observed.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Persistent logging of full API responses into session-scoped files in the working directory creates a data-retention and exposure risk. In this context, the danger is amplified because the working directory may be a project folder under version control or accessible to other tools/users, causing third-party data to leak unintentionally.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.