Jungle Scout-关键词历史

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.7

Overview

This keyword lookup skill also includes account signup, API key generation, payment ordering, automatic feedback reporting, and mandatory local storage, so users should review it carefully before installing.

Install only if you are comfortable with this skill handling LinkFox/Jungle Scout account setup, API keys, paid credit usage, and payment-order workflows. Prefer creating accounts, adding credits, and storing API keys through the first-party website yourself; verify LinkFox endpoint environment variables before use; and expect keyword queries and full API responses to be saved under a local linkfox directory or fallback location.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target is ultimately derived from environment-controlled base URLs, and this request can carry sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens. In a skill/execution environment where env vars may be influenced by a host, wrapper, or attacker, this creates a server-side exfiltration path to arbitrary endpoints.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL is built from environment-supplied base configuration and then used in urlopen with the Authorization header populated from environment API keys. If an attacker can influence the environment, they can redirect authenticated requests and harvested credentials to infrastructure they control.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes use of environment variables, network access, and file writes, but no explicit permissions model is declared. This creates a transparency and governance gap: a user may invoke what appears to be a simple analytics skill without realizing it can access credentials, call remote services, and persist data locally. In an agent setting, undeclared capabilities increase the risk of unauthorized data handling and make abuse harder to detect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a keyword history lookup tool, but the referenced behavior includes account login, API key generation/retrieval, subscription plan browsing, payment order creation, QR-code payment generation, and payment-status checks. That is a major scope expansion into authentication and billing workflows, which can expose users to credential handling, unintended purchases, or hidden account actions unrelated to the stated purpose. In this context, the mismatch is especially dangerous because users would not reasonably expect a search-volume skill to trigger commerce or account-management operations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documentation embeds a separate feedback submission API that is unrelated to the keyword-history function, creating an unexpected secondary action surface inside the skill. In an agent setting, this can prompt unintended outbound data submission containing user content or operational details to a different service, which increases data exfiltration and prompt-injection risk even if the endpoint is legitimate.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This onboarding document introduces authentication recovery, account registration, API-key setup, and billing/payment workflows that are unrelated to the stated purpose of a keyword-history lookup skill. In this context, expanding the skill into credential handling and payment collection increases attack surface, enables scope creep, and creates opportunities for social-engineering or unauthorized data collection under the guise of analytics support.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The instructions tell the agent to collect a user's phone number and drive send-code/login flows through a script, even though phone-based registration is not necessary for a keyword trend query. That creates unjustified collection of personal data and trains users to share sensitive identifiers with an agent, which can be abused for account takeover, spam enrollment, or privacy violations if the script or surrounding workflow is compromised.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The document includes plan listing, payment-method selection, order creation, and payment-status querying, which are outside the scope of a keyword analytics skill. Embedding commerce flows into an unrelated skill makes phishing and payment diversion more plausible, and could cause users to authorize purchases based on agent prompts rather than trusted billing interfaces.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a query tool, but it persistently stores full API responses, cache entries, and session metadata on disk. This creates unnecessary local data retention and can expose user queries, response contents, and session identifiers to other local users, backups, or later processes.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documentation explicitly says writing to /tmp is forbidden and that failure to write in the current directory should error out, but the implementation silently falls back to the home directory and then the temp directory. This mismatch defeats operator expectations and can cause sensitive outputs to be written into less trusted or more broadly accessible locations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file advertises itself as a keyword-history skill but implements account onboarding, SMS login, token retrieval, package listing, ordering, and payment QR generation. This capability mismatch is dangerous because it broadens the blast radius from analytics into credential capture and billing actions that users would not expect from the declared skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This section performs authentication, new-user token login, user/team enumeration, and API token generation rather than keyword trend retrieval. In the context of a search-volume history skill, these hidden privileged flows are highly suspicious and can be used to obtain reusable credentials unrelated to the user’s stated task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code can create orders, query payment state, and render payment QR codes despite the skill being described as keyword trend analysis. Unrelated commerce capabilities increase the chance of unauthorized purchases or deceptive monetization flows triggered under an analytics pretext.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code retrieves or generates API tokens for a group/account, which are durable authentication artifacts unrelated to the declared keyword-history purpose. In this context, token provisioning is especially dangerous because it can silently bootstrap persistent access beyond the immediate user request.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger text is intentionally broad enough to activate on generic phrases like search volume, popularity, or market-demand trends even when the user did not ask for Jungle Scout specifically. Because this skill consumes paid credits and writes results to disk, overbroad triggering can cause unintended third-party queries, unnecessary charges, and silent data persistence from ordinary conversation. The context makes this more dangerous, not less, because activation is tied to external API usage and cost.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to always write full API responses to project-local files, but it does not provide a clear user-facing warning that query inputs and returned data will be retained on disk. Even if the content is business-oriented, stored keyword research, session grouping, and response metadata can expose user activity patterns or sensitive commercial research to other processes or collaborators with filesystem access. Mandatory persistence without informed disclosure is a data-handling vulnerability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs automatic feedback reporting whenever the model detects mismatch, user sentiment, or possible improvements, without clearly warning the user that parts of their interaction may be sent to another API. This can leak conversation content, usage context, or dissatisfaction signals to a third party without informed consent. In a paid commerce-adjacent tool, silent telemetry is particularly risky because it may include commercially sensitive research intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow instructs the agent to ask for a phone number and use it in registration/login commands without any privacy disclosure, consent language, retention details, or explanation of where the data is sent. In a support context this omission materially increases privacy risk because users may disclose personal data without understanding processing, storage, or downstream access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends user-supplied parameters plus environment-derived session metadata to a remote service without any explicit notice at the call site. In this skill context, the network call is expected, but the hidden transmission of metadata and the broad local persistence make the disclosure more sensitive than a minimal API client.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The code handles access tokens, refresh tokens, user identifiers, and generated API keys and then emits the API key in command output, but provides no in-file warning, masking, or secure storage guidance. In a skill environment this can expose secrets to logs, transcripts, downstream tools, or users who did not understand they were authorizing credential issuance.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill mandates storing full API responses in session-grouped project-local files, which creates durable records of user queries and results beyond the immediate task. Such retention increases exposure to accidental disclosure through source-control commits, shared workspaces, backups, or later agent access, especially because the storage path is inside the current project directory rather than an isolated secure cache. The risk is amplified by session-based grouping, which can help correlate multiple user actions over time.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.