Jungle Scout-关键词拓展

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 1.0.7

Overview

The keyword research function is coherent, but the package also includes sensitive account, payment, API-key, and automatic feedback flows that need review before installation.

Install only if you are comfortable with LinkFox handling keyword queries, API credentials, SMS onboarding data, and optional billing flows. Do not provide SMS codes or create payment orders unless you intentionally want account setup or recharge support, and avoid automatic feedback submission with sensitive prompt, business, or customer data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target is derived from environment-controlled base URLs and is used to send login data, tokens, and other sensitive account material over the network. In a skill/onboarding context, allowing unvalidated environment overrides enables SSRF and exfiltration of credentials to attacker-controlled endpoints if the runtime or packaging environment is tampered with.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is built from environment variables and then used by urllib with the API key placed in the Authorization header. If an attacker can influence environment configuration, they can redirect requests to an external server and capture the API key or coerce the process into making internal network requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require access to environment variables, file writes, and networked API calls. This creates a capability-transparency gap: operators and users cannot accurately assess what the skill will access or transmit, which weakens trust boundaries and review controls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The described skill is a keyword research tool, but the referenced behavior includes account login, SMS verification, API key issuance, account lookup, subscription purchase, payment order creation, QR rendering, and order-status polling. That is a major scope expansion into authentication and payments, which can expose sensitive user data and enable unintended external actions far beyond the user's likely intent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file documents a separate feedback submission API that is outside the stated purpose of keyword expansion, creating an unexpected secondary data flow. This can cause an agent to send user-derived content to another external service without clear need, increasing the risk of privacy leakage and scope creep even if the endpoint itself is legitimate.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API key retrieval, plan listing, and payment operations, which are materially unrelated to a keyword expansion skill. That mismatch is dangerous because it expands the skill's privilege and data collection surface beyond user expectations, creating an opportunity to harvest credentials and drive monetization flows under a misleading capability label.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can enumerate purchasable plans, create payment orders, and render payment QR codes even though the declared skill is for keyword research. In this context, embedded billing logic is especially risky because it can trigger purchases or steer users into payment flows that are not necessary for the advertised functionality.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This section performs SMS-based login and API key generation for the user, far beyond the needs of keyword expansion. Within a mislabeled skill, collecting phone numbers and verification codes and then minting credentials is highly sensitive and can enable account takeover, unauthorized API access, or covert credential harvesting.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Feedback API instructions encourage posting free-form content to a separate external endpoint but do not warn that user content may be transmitted off-system. In an agent setting, this omission can lead to accidental disclosure of sensitive prompts, business data, or personal information in feedback payloads.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs operators to collect a user's phone number and pass it to a script for registration/login, but it provides no privacy notice, consent flow, retention guidance, or limits on how that personal data is handled. In a support/onboarding context this creates unnecessary privacy and compliance risk, especially if agents solicit phone numbers directly from users.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The login command emits the generated API key to stdout JSON, which may be captured by logs, calling frameworks, transcripts, shell history, or downstream tools. Exposing long-lived credentials in routine command output increases the chance of accidental leakage and unauthorized reuse.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill instructs automatic feedback reporting whenever dissatisfaction, praise, mismatch, or anything improvable is detected, without defining what user content is sent. That creates a real risk of exfiltrating user-provided text, business context, or identifiers to an external Feedback API without informed consent or data minimization.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.