Jungle Scout-关键词声量份额

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.7

Overview

The skill mostly supports the advertised Amazon Share of Voice lookup, but it also includes account setup, token generation, billing/order flows, automatic feedback reporting, and local data retention that need review.

Review before installing. Use this only if you are comfortable sending Amazon keyword queries, session metadata, and API credentials to LinkFox services, storing full results locally, and potentially using the included account and billing helpers. Prefer getting any API key directly from the official LinkFox site, verify LINKFOX_* endpoint environment variables are not set to unexpected hosts, and avoid using the payment/order path unless you intentionally want to buy credits.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive login data, SMS verification payloads, access tokens, refresh tokens, and group/token-management requests to those endpoints via requests.post. If an attacker can influence environment variables, they can redirect these authenticated flows to an attacker-controlled server and exfiltrate credentials and API tokens; the skill context increases risk because this file explicitly handles account onboarding and key issuance rather than core analytics.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway client constructs a URL from environment-derived base configuration and sends authenticated requests with the LINKFOX_AGENT_API_KEY in the Authorization header using urlopen. A malicious environment override can redirect these privileged API calls to an attacker endpoint, exposing the API key and enabling unauthorized account, package, order, or billing actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares itself as a keyword analysis tool, yet its instructions require access to environment variables, outbound network calls, and persistent file writes without any explicit permission model or minimization boundaries. That combination enables exfiltration of sensitive data from API responses, session identifiers, or credentials and increases the blast radius if the skill is triggered unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a Share of Voice analytics tool, but the referenced behavior includes account login, API key generation, billing, order creation, payment QR generation, and payment-status queries. This is a major scope expansion into authentication and financial operations, which could cause unauthorized account actions or purchases if invoked under the guise of ordinary analytics.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically send user feedback, dissatisfaction, praise, or any perceived improvements to a separate Feedback API without asking the user. This creates an unrelated secondary data flow that may transmit user content or behavioral metadata beyond what is necessary for keyword analysis.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documentation embeds a separate public feedback submission API that is unrelated to the core Share of Voice retrieval function. In an agent skill context, mixing operational API docs with an outbound reporting endpoint can cause agents or wrappers to send user content to an unintended external service, creating a data exfiltration and scope-creep risk, especially if user queries or results are included in feedback content.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The onboarding document introduces authentication recovery, user registration, and billing workflows that are unrelated to the declared Share of Voice analytics purpose of the skill. In an agent context, this unnecessarily expands the skill’s operational scope into credential handling and payment enablement, increasing the chance of data collection, social engineering, or unauthorized account actions.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The documented flow allows collecting a user’s phone number, sending verification codes, logging in, and initiating plan purchases, none of which are justified by a keyword market-share analytics function. This creates an unjustified pathway for sensitive account operations and monetary transactions that could be abused or mishandled if the skill is triggered inappropriately.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is described as an analytics retrieval tool, but it persistently stores full API responses, cache entries, and session metadata on local disk. This can create unintended data retention of potentially sensitive business intelligence, query terms, and account-linked metadata beyond what a user expects from a simple fetch operation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring states that writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to home and temporary directories. This mismatch can cause data to be written into less trusted or less expected locations, increasing the chance of exposure on shared systems.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements SMS login, API key acquisition, subscription management, order creation, and payment QR generation, which are unrelated to the declared Share of Voice keyword analytics purpose. Such scope expansion is dangerous because it collects user credentials and enables financial/account operations that users would not expect from an analytics skill, materially increasing abuse potential.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill contains order creation and payment QR rendering logic, allowing it to initiate billing workflows despite being presented as a keyword market-share analytics tool. In this context, monetization and payment capabilities are unjustified and create a path for unexpected charges, social engineering, or abuse of a user's linked account.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code fetches or generates LinkFox API tokens after SMS login, which exceeds the least-privilege needs of a Share of Voice analytics skill. Token provisioning is sensitive because it can grant broader API access than required and turns this skill into a credential bootstrapper rather than a narrowly scoped analytics utility.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger criteria are broad enough to activate on generic requests about competition, brand analysis, or market landscape, even when the user may not intend to use this paid external tool. Because the skill performs network calls and incurs cost, over-triggering can lead to unnecessary data sharing, charges, and execution of side effects outside user expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to ask for a user’s phone number and transmit it to a script, but it does not provide an explicit privacy notice, data-use explanation, retention statement, or sharing disclosure. Collecting personal data this way can lead to privacy violations, uninformed consent, and exposure of sensitive identifiers to backend tooling the user may not understand.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The script sends user-supplied request parameters together with session metadata headers to a remote service without explicit runtime disclosure. In a skill context, this can expose business-sensitive search intelligence and internal session identifiers to an external gateway when users may expect only local processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: This external transmission is security-relevant because the request function is used for login and token-handling flows, sending sensitive account data to remote services. In combination with environment-configurable endpoints, the network egress can become credential exfiltration rather than legitimate service communication.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.