Jungle Scout-商品库

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.7

Overview

The skill performs the advertised Jungle Scout product search, but it also handles phone-based login, API key issuance, paid-plan ordering, payment QR generation, and automatic feedback reporting, which is broader and more sensitive than a product-filtering skill suggests.

Review this skill carefully before installing. It may be acceptable if you intend to use LinkFox/Jungle Scout through this agent and are comfortable with paid API calls, local result caching, phone-based account onboarding, and payment-plan flows. Avoid using the embedded onboarding commands unless you trust the publisher and endpoint configuration; do not share OTPs casually, and treat any API key printed by the script as a secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code sends authentication material and other request data to URLs whose base can be overridden by environment variables via _login_base() and _agent_user_base(). In a skill/runtime environment, a malicious or compromised host can redirect these requests to attacker-controlled endpoints, causing SMS login tokens, access tokens, refresh tokens, API keys, and user metadata to be exfiltrated.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request path uses _agent_base(), which is derived from environment variables, then attaches the API key in the Authorization header before calling urlopen(). If an attacker can influence environment configuration, they can redirect these authenticated requests to an attacker-controlled server and capture the API key and subsequent account/order traffic.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while its instructions clearly require access to environment variables, file writes, and network endpoints. This creates a transparency and consent problem: an agent may perform sensitive actions such as reading API keys, writing local artifacts, and making external requests without the capability being explicitly surfaced to the user or platform policy layer.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a product-database query tool, but the referenced onboarding flow enables unrelated account, authentication, billing, and payment operations including SMS login, API key generation, plan purchase, and payment status checks. That mismatch is dangerous because it expands the trust boundary far beyond product search and can lead an agent to collect phone numbers, manage credentials, or initiate purchases under the guise of a benign research skill.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The documentation instructs automatic use of a separate Feedback API whenever various conditions occur, without clear relation to the user's requested product-database task. This can cause unsolicited outbound data transmission about user interactions, satisfaction, and task details, creating privacy and scope-creep risks if conversation content is sent to another endpoint without explicit consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation introduces a separate feedback submission API that is unrelated to the skill’s core product-database query function. This expands the skill’s effective capability surface and creates a path for transmitting user-derived content to an external service without clear necessity, increasing the risk of unexpected data egress or misuse by an agent that follows the docs literally.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: A feedback-posting capability is context-inappropriate for a skill whose stated purpose is Amazon product filtering. In agent environments, out-of-scope endpoints can be abused to exfiltrate user prompts, results, or behavioral metadata under the guise of telemetry or feedback, especially when no strict trigger criteria are documented.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The onboarding document introduces account-authentication recovery, registration, and billing/payment workflows that are materially outside the stated purpose of an Amazon product-database filtering skill. This broadens the skill into credential and payment handling, creating unnecessary access to sensitive workflows and increasing the chance of phishing, abuse, or unauthorized collection of user data.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs operators to collect a user's phone number and run login/registration flows, which is unjustified for a product research/filtering function. Collecting phone numbers and handling OTP-based login materially increases the risk of privacy violations, account takeover assistance, and misuse of sensitive personal data.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The billing section enables plan enumeration, order creation, payment-method selection, and payment-status queries even though the skill is described as a product database filter. Embedding payment workflow logic in an unrelated skill increases the attack surface for social engineering, fraudulent charging flows, and misuse of payment-related metadata.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module docstring explicitly says writing to /tmp is forbidden, but _linkfox_root() falls back to tempfile.gettempdir(), which commonly resolves to /tmp. This contradiction can cause sensitive API responses and session metadata to be written to less controlled shared temporary storage, increasing exposure to other local users, cleanup daemons, or accidental disclosure.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is described as a product database filter, but this file implements account onboarding, SMS authentication, API key issuance, package listing, order creation, and payment QR generation. This is a strong scope mismatch that expands the skill into credential handling and billing operations users would not reasonably expect from a filtering skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create orders and generate payment QR codes even though the stated purpose is Amazon product filtering. Billing capability materially increases risk because it can trigger purchases or social-engineer payment actions under the guise of a benign research skill.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The login flow provisions access tokens and returns an API key to stdout, which exceeds the stated need of filtering products. In this context, issuing reusable credentials is especially dangerous because it broadens compromise from a single task to ongoing account access.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger conditions are overly broad and allow activation for generic product-discovery intents even when the user does not mention Jungle Scout or a product database. Overbroad activation increases the chance that the agent invokes a paid external service, writes files, or sends data to third parties for loosely related requests the user did not intend to route through this skill.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The boundary guidance still treats vague phrases like '选品', '找产品', and '市场调研' as sufficient if the model infers filtering intent, which leaves room for misrouting ordinary research requests into this tool. In context, that is risky because the skill can incur dynamic charges and perform external queries, so ambiguous invocation can create unauthorized cost and data-sharing consequences.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The feedback API instructs sending free-form feedback content to an external endpoint but provides no privacy notice, disclosure, minimization guidance, or consent requirement. This is dangerous because user statements, intents, and possibly sensitive commercial research context could be transmitted off-platform without user awareness or legal/privacy review.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document tells operators to ask for a user's phone number and process registration/login without any privacy notice, retention guidance, or safe-handling requirements. Even if intended for support, collecting personal identifiers without clear safeguards can lead to overcollection, accidental disclosure, or policy noncompliance.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The login command emits the acquired API key directly in JSON output without any built-in warning, masking, or safer storage mechanism. In agent environments, stdout is often logged, surfaced to other components, or retained in transcripts, which can leak a reusable secret.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This code performs external transmission of login and account data, including potentially sensitive authentication material. External transmission is expected for networked services, but here it becomes dangerous because destination control is partly environment-driven and the file's declared purpose does not justify handling such secrets.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.