Security audit

Jungle Scout-ASIN反查关键词

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does the advertised ASIN keyword lookup, but it also includes account login, API-key generation, payment ordering, automatic feedback reporting, and persistent local logging that deserve user review.

Install only if you are comfortable using LinkFox/Jungle Scout as a paid remote service. Prefer getting and setting the API key yourself through the first-party site instead of giving an agent your phone number and SMS code. Confirm any credit usage, plan choice, or payment order before proceeding, and be aware that full lookup results, cache files, session metadata, and payment QR images may be written under a local linkfox directory. Treat the automatic feedback behavior as an extra data-sharing path unless it is removed or made opt-in.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation describes capabilities that require environment access, network calls, and file writes, yet no explicit permissions model or scoped declaration is present. This creates a least-privilege failure: operators and users cannot accurately assess what the skill can access, and hidden capabilities increase the chance of unintended data exposure or misuse.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The stated purpose is ASIN keyword lookup, but the skill also references SMS login, API-key retrieval, account data access, subscription plans, payment order creation, QR rendering, and order-status queries. That is a major scope expansion into identity, billing, and account-management functions, which increases the attack surface and could collect or process sensitive user data unrelated to the user's original intent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill instructs automatic reporting to a separate Feedback API whenever various conditions occur, including dissatisfaction, praise, or general improvement opportunities. Automatic transmission to another endpoint is not necessary for performing ASIN keyword lookup and can leak user prompts, tool outputs, or behavioral metadata without clear consent or minimization.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The API reference for an ASIN keyword lookup skill includes a separate feedback-reporting endpoint that is unrelated to the core tool function. In agent/tooling contexts, extra outbound endpoints expand the action surface and can cause agents to transmit user content to a secondary service without clear necessity, increasing privacy and unintended data exfiltration risk.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements SMS login, token acquisition, account/package discovery, order creation, and payment QR generation, which are materially unrelated to the advertised ASIN reverse-keyword research capability. In a skill ecosystem, this mismatch is dangerous because it expands the permission and data-collection surface to account onboarding and commerce flows users would not reasonably expect from a keyword lookup tool.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Embedding purchase and payment workflows inside a keyword-analysis skill introduces unnecessary financial functionality and the ability to steer users into transactions outside the stated purpose. This increases risk of unauthorized purchases, phishing-like payment collection, and user confusion about what the skill is allowed to do.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code fetches or generates persistent API tokens for the user, which exceeds what is justified for a simple reverse-ASIN lookup skill and creates durable credential material that could be reused beyond the immediate action. In the skill context, this is especially sensitive because users expect a bounded lookup task, not long-lived credential provisioning.

Vague Triggers

High

Confidence: 88% confidence
Finding: The trigger conditions are broad enough to match generic requests about keywords, traffic terms, competitor analysis, or keyword expansion even when the user did not ask for reverse-ASIN lookup specifically. This can cause unintended tool invocation, unnecessary third-party data sharing, and unexpected paid API consumption on ambiguous requests.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The onboarding flow explicitly instructs collecting a user's phone number and SMS verification code and sending them through a script, but it does not require a clear privacy notice, purpose limitation, or safe handling guidance. This creates unnecessary risk of exposing sensitive authentication data and may normalize unsafe credential-sharing behavior between user and agent.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The skill sends user-supplied parameters plus SESSION_ID, MODE_ID, and APP_NAME to a remote service and persists the full API response locally. In this skill context, transmitting data to Jungle Scout is the intended function, but the lack of explicit user-facing disclosure and broad metadata forwarding creates a real privacy risk, especially if users assume local-only processing or if metadata can identify sessions across tasks.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill requires persistent logging of full responses into session-scoped files under the working directory, even when only a summarized answer is needed. Persistent storage of full tool outputs increases the risk of retaining user-supplied identifiers, account-related data, or commercially sensitive query results beyond the immediate task, especially in shared project directories.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.