Jungle Scout-关键词拓展

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.8

Overview

The keyword tool mostly matches its advertised purpose, but it also includes automatic feedback reporting plus account, credential, and payment workflows that deserve careful review.

Review this skill before installing if you are comfortable sending keyword research, account identifiers, and possibly phone/SMS authentication data to LinkFox services. Use official self-service account and billing pages when possible, avoid exposing API keys in chat or logs, verify LINKFOX_* endpoint variables are not overridden, and require explicit consent before any feedback or payment action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:205

Finding

Automatic Disclosure of Conversation-Derived Feedback to an External Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/junglescout_keyword_by_keyword.py:36

Finding

Credential Exfiltration Through Unvalidated API Endpoint Overrides

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key 未配置", file=sys.stderr, ) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` The onboarding script independently permits login and account-service overrides: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ### Technical Analysis The network destinations are accepted directly from environment variables with ...[truncated 2240 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:486

Finding

Generated API Key Is Exposed in Standard Output and Agent Transcripts

Content

View full analysis

int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboarding instructions subsequently direct the key into persistent shell configuration: ```text setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The login command returns the generated API key as a normal JSON field and `_emit` prints the entire object to standard output. In an Agent environment, standard output may be captured by: - Conversation transcripts. - Tool execution records. - CI/CD logs. - Terminal scrollback. - Session recordings. - Debug and observability systems. The reference instructions also encourage interpolating the secret into shell commands. This can expose it in terminal history, process telemetry, copied chat messages, shell startup files, and backups. Although returning a key is part of onboarding, exposing it through general-purpose stdout and Agent-visible text is not the least-privilege delivery mechanism. ### Attack Path 1. A user enters a phone number and SMS verification code. ...[truncated 922 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/junglescout_keyword_by_keyword.py:179

Finding

Full API Responses May Be Written to Shared Temporary Storage with Default Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/junglescout_keyword_by_keyword.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material such as SMS login data, access tokens, refresh tokens, and generated API keys to those endpoints via requests.post. If an attacker can influence environment variables, they can redirect these flows to attacker-controlled infrastructure and exfiltrate credentials or payment-related data.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is also derived from environment input and used in urlopen with an Authorization header carrying the API key. A manipulated environment can redirect package lookup, account, and order requests to a hostile server, leaking the API key and enabling account misuse or fraudulent order manipulation.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is keyword expansion, but the underlying behavior reportedly includes login, SMS verification, API key generation, user/team retrieval, subscription management, payment/order creation, QR-code payment flows, and order-status checks. That is a major capability mismatch that can expose users to undisclosed account actions, billing operations, and collection of sensitive identity/payment data far outside the advertised task.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

}

text

## Display Rules

1. **表格优先**：以表格展示关键词列表，核心列包括：关键词、精确搜索量、广泛搜索量、月度趋势、PPC精确出价、排名难度
2. **按需裁剪列**：根据用户意图决定展示列——PPC研究场景侧重出价列，拓词场景侧重搜索量和趋势

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This skill is described as a keyword expansion tool, but the code implements account onboarding, SMS login, API key retrieval, package listing, ordering, and payment QR generation. That scope mismatch is dangerous because it introduces credential collection and billing behavior users would not reasonably expect from a keyword research skill, increasing phishing and abuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code performs order creation and renders payment QR codes, which is unrelated to keyword expansion and enables billing actions within an unexpectedly scoped skill. In this context, concealed purchasing capability materially raises the risk of unauthorized charges, social engineering, and user confusion about what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script logs users in via SMS and generates or retrieves API keys, directly handling high-value credentials far beyond the stated keyword research purpose. In a skill ecosystem, that mismatch makes the behavior especially dangerous because users may provide phone numbers and codes under false assumptions, enabling credential harvesting or account takeover if anything is misconfigured or abused.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares no explicit tool restrictions even though it relies on environment access, file writes, and network access. In an agent environment, missing scope boundaries increases the blast radius: the skill can access secrets, persist data locally, and contact external services without transparent least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to activate on generic keyword research requests, not just this specific Jungle Scout expansion workflow. Over-broad triggering can cause unnecessary external calls, unintended data disclosure to third-party services, and user confusion about which tool is being invoked.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs automatic feedback reporting based on user reactions or perceived improvements, creating an undisclosed monitoring/reporting channel unrelated to the core keyword-expansion function. This can transmit user statements, satisfaction signals, and possibly task context to an external API without clear consent or necessity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file instructs users to read an API key from environment variables and place it in the Authorization header, which is a sensitive credential operation. The document does not include any warning about protecting the key, avoiding logging/sharing it, or treating request examples carefully, so the credential-handling behavior lacks user disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 125)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/tool-jungle-scout/keywords/by-keyword \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file documents a separate feedback-posting API that is unrelated to the keyword-expansion capability of this skill. Adding an auxiliary write-capable endpoint expands the skill’s effective scope and can enable unsolicited outbound data transmission, especially if an agent is induced to send user content or conversation summaries to that endpoint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The onboarding document expands the skill’s behavior beyond keyword research into account recovery, registration, API key setup, and billing flows. That creates unnecessary handling of credentials, account state, and payments in a skill whose stated purpose is keyword expansion, increasing attack surface and the chance the agent solicits sensitive actions from users under an unrelated pretext.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document instructs the agent to ask for a user’s phone number and use it with a registration/login script, even though phone-based account creation is not necessary for keyword expansion itself. Collecting personal contact information and using it in an agent-driven auth flow can expose users to privacy loss, account takeover risk, and social-engineering abuse if the skill or surrounding system is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks for a user’s phone number and uses it in a login/registration process without warning about privacy implications, retention, or who receives the data. In the context of a keyword tool, this omission is especially risky because users would not reasonably expect to share personal contact data for the advertised function.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation includes plan listing, payment-method selection, order creation, and payment-status handling, which are unrelated to keyword expansion and materially broaden the skill into commerce operations. Embedding payment flows in a content-research skill raises phishing and fraud risk because users may be induced to purchase plans or follow payment links/QR codes outside a clearly separated billing interface.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module documentation explicitly says writing to /tmp is forbidden, but _linkfox_root() falls back to tempfile.gettempdir()/linkfox when other locations are unavailable. This mismatch can cause sensitive API responses to be persisted in a less controlled temporary location contrary to operator expectations, increasing the chance of unintended exposure or forensic blind spots.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script sends request metadata from environment variables such as SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME as HTTP headers to a remote gateway. While the module docstring explains output/file-writing behavior, this code does not provide a user-facing warning or disclosure that these environment-derived identifiers are transmitted over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script persistently writes full remote API responses to disk by default, and those responses may contain sensitive business data, identifiers, or user-supplied content. In an agent environment, silent persistence increases the risk of data leakage through shared workspaces, backups, or later unintended access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module description and command/help text are entirely in Chinese, and the workflow is explicitly tied to Chinese phone numbers and +86 area code. The file does not offer any language or locale choice or document that this is a region-specific skill, which violates the policy against forcing a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The instruction "When the user does not specify a marketplace, use us" imposes a locale/market choice automatically. Because this affects regional context and is not presented as a user choice, it can violate language/locale policy expectations requiring opt-in or clearly justified constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.