Jungle Scout-ASIN反查关键词

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.8

Overview

This ASIN keyword skill has a real analytics purpose, but it also gives the agent broader account, payment, credential, storage, and silent feedback-reporting behavior that users should review before installing.

Install only if you are comfortable with LinkFox handling your ASIN queries, API key, session metadata, and optional phone/SMS onboarding. Avoid using endpoint override environment variables, do not store long-lived API keys in shell startup files if you can use a safer secret store, and do not allow automatic feedback submission unless you have reviewed exactly what will be sent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:214

Finding

Automatic Disclosure of User Conversation Content Through the Feedback API

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/junglescout_keyword_by_asin.py:36

Finding

Environment-Controlled Endpoints Can Redirect Credentials and Authentication Data

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH ``` The resulting request carries the API key: ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script similarly accepts environment-controlled authentication endpoints: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive onboarding requests use these values and can contain a phone number, SMS verification code, API key, access t ...[truncated 1879 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:468

Finding

Generated API Key Is Exposed Through Standard Output and Plaintext Shell Configuration

Content

View full analysis

int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key acquired", file=sys.stderr) return 0 return 1 ``` The onboarding documentation then instructs users to place the key in shell commands and persistent startup files: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis Standard output is commonly captured by Agent execution contexts, terminal scrollback, command wrappers, CI logs, audit systems, or pipelines. Returning the raw key in JSON therefore unnecessarily expands its exposure. Embedding the key directly in a shell command may record it in shell history. Appending it to `.zshrc` or `.bashrc` stores a long-lived credential in plaintext and makes it readable by any process or user that can access those files. The Skill's declared keyword lookup functionality requires using the key, but it does not require displaying the complete credential to the Agent or retaining it in shell startup configuration. ### Attack Path 1. A user submits a phone number and SMS code through the onboarding workflow. 2. The script obtains or generat ...[truncated 864 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/junglescout_keyword_by_asin.py:250

Finding

Unsanitized Session Identifier Allows Output Path Traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script has the same issue: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` Subsequent operations write API responses, metadata, or payment QR images beneath the resulting path. ### Technical Analysis `SESSION_ID` is not validated before it is passed to `os.path.join`. Values containing `..` components can escape the intended session root. On platforms where the supplied component is treated as absolute, it can also replace preceding path components. Although generated filenames are partially fixed, the attacker can control the destination directory. Existing predictable metadata files such as `_meta.json` can be overwritten when the selected directory is reused. ### Att ...[truncated 1095 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/junglescout_keyword_by_asin.py:201

Finding

Sensitive Output Silently Falls Back to Home and Shared Temporary Directories

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:32

Finding

Runtime Instructions Install Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The request URL and outbound headers are influenced by environment variables, including LINKFOX_TOOL_GATEWAY and multiple metadata fields, so a manipulated runtime environment can redirect traffic to an attacker-controlled endpoint and exfiltrate the API key and session metadata. In this skill context, the script is explicitly designed to call a remote service with credentials, which makes environment-driven SSRF/exfiltration more dangerous than a generic network call.

Content

Scanner excerpt · scripts/junglescout_keyword_by_asin.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The code sends authentication material and account data to a URL derived from environment-controlled base endpoints via requests.post. If an attacker can influence LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect SMS login tokens, access tokens, refresh tokens, user IDs, or generated API keys to an attacker-controlled server, resulting in credential exfiltration and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The gateway request uses urllib to contact a URL built from environment-controlled API base settings and includes the Authorization API key header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can redirect these requests to a malicious endpoint and harvest API keys, billing/order data, and user/account information.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as an ASIN keyword lookup tool, but the documented behavior and referenced onboarding flow extend into SMS login, API-key generation, account/team-space access, subscription/package listing, order creation, payment initiation, QR-code generation, and payment-status checks. This is a major capability mismatch that can mislead users and agents into triggering account, billing, and identity-related actions under the guise of analytics, increasing risk of unauthorized purchases, privacy exposure, or credential abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is so broad that it can match generic keyword-analysis requests even when the user did not ask for ASIN-based reverse lookup or Jungle Scout data specifically. Overbroad routing can cause the wrong skill to activate, leading to unnecessary external queries, extra cost consumption, or entry into the skill's auxiliary auth/billing flows despite weak user intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

}

text

## Display Rules

1. **表格展示为主**：以表格形式展示关键词列表，核心列包括：关键词、精确搜索量、自然排名、广告排名、相关度、PPC 出价
2. **按需精简列**：根据用户意图选择展示列。竞品分析侧重排名和搜索量；广告分析侧重 PPC 出价和广告排名

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements account onboarding, SMS authentication, API-key retrieval, package discovery, and payment handling, which are unrelated to the declared reverse-ASIN keyword lookup purpose. The mismatch is dangerous because users invoking a keyword-analysis skill would not reasonably expect account enrollment and commerce flows, increasing the chance of covert credential collection and unauthorized monetization.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill can create orders and render payment QR codes even though its advertised purpose is ASIN keyword research. Embedding purchase flows inside an unrelated analytics skill creates a strong risk of deceptive charges, social engineering, and unauthorized financial transactions under the guise of normal tool use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares no explicit tool scope while its documented behavior requires environment-variable access, file writes, and network calls. Without a permissions/allowed-tools boundary, an agent may invoke broader capabilities than users expect, weakening least-privilege controls and making any future prompt injection or logic error more damaging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file instructs the agent to default to the US marketplace when the user does not specify a marketplace. This imposes a specific locale choice automatically rather than asking the user or offering a selection, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 141)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/tool-jungle-scout/keywords/by-asin \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents a separate feedback-posting endpoint that is unrelated to the core ASIN keyword lookup function. In an agent skill context, this expands the skill's effective capability surface and can enable transmission of user content or interaction details to another external service without being necessary for fulfilling the requested task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The onboarding flow explicitly asks the user to provide a phone number and verification code so a local script can register/login on their behalf, but it does not provide any privacy notice, consent guidance, data-handling limits, or retention/deletion instructions. This creates a real privacy and account-security risk because the workflow normalizes collection and transmission of sensitive personal data and authentication factors without documenting safeguards.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented behavior promises not to write to /tmp and to fail if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This can cause sensitive API responses to be persisted in less controlled locations than operators expect, weakening data handling guarantees and potentially exposing marketplace intelligence or session-linked data to other local processes or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script transmits SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME to the remote API without any gating, minimization, or user-visible disclosure. In this skill context, these identifiers may enable cross-request correlation and leak internal application metadata to the external service, increasing privacy and tracking risk beyond the core ASIN lookup purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code performs SMS-based login, token exchange, team enumeration, and API-key generation despite the skill being described as an ASIN keyword mining capability. In this context, collecting phone numbers, verification codes, and issuing API credentials is excessive and enables credential harvesting or account takeover under false pretenses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The CLI help for the phone argument explicitly requires an "11 位国内手机号", and the implementation hard-codes areaCode "+86" for SMS login flows. This constrains the skill to a China-specific locale without offering any user choice or documenting it as an intentional region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's operational instructions and user-facing guidance are all in Chinese, and there is no indication that the skill is region-specific or that users may opt into another language. This can violate language/locale policy when a skill effectively forces one language without justification or choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment above SMALL_THRESHOLD says responses below the threshold are directly output and 'not written to file'. But main() always resolves an output path and writes the serialized response before deciding whether to print inline or summarize, so the comment is materially false about persistence behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script reads API credentials from LINKFOX_AGENT_API_KEY or LINKFOXAGENT_API_KEY to authenticate outbound requests. Although using an API key is expected for this integration, the code lacks an explicit user-facing disclosure that environment credentials are being consumed for a remote service call.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.