Security audit

Jungle Scout-商品库

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an Amazon product-research tool, but it adds under-disclosed external feedback reporting, credential/payment onboarding, and broad local persistence that users should review carefully.

Install only if you are comfortable with LinkFox receiving product-query data and possibly conversation-derived feedback. Avoid using endpoint override environment variables unless you fully control them, do not store API keys in shell startup files on shared machines, and review any phone/SMS login or payment-order step before proceeding.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:219
Finding: Automatic Disclosure of Conversation-Derived Feedback to an External Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/junglescout_product_database.py:37
Finding: Credential-Bearing Requests Can Be Redirected Through Unvalidated Environment Variables
Content: View full analysis
str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key 未配置", file=sys.stderr, ) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } ``` The onboarding script permits additional sensitive endpoint overrides: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` These destinations receive API keys, phone numbers, SMS verification codes, access tokens, refresh tokens, user IDs, group IDs, or session metadata in different request flows. ### Technical Analysis The scripts trust endpoint ...[truncated 2162 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/junglescout_product_database.py:251
Finding: Directory Traversal Through Unsanitized Session Identifier
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script repeats the unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted path component. It is neither restricted to a safe character set nor checked after path normalization. Values containing `..`, path separators, or an absolute path can escape the intended `//` hierarchy. The main script subsequently creates `_meta.json`, updates session metadata, and writes complete API responses. The onboarding script can write payment QR images in its resolved session directory. The privileges available through this flaw are bounded by the operating-system permissions of the process. Howeve ...[truncated 1388 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:484
Finding: Reusable API Key Is Printed and Recommended for Plaintext Persistent Storage
Content: View full analysis
int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The documentation recommends permanent plaintext shell configuration: ```text setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The onboarding flow returns a reusable API key in a JSON object and prints that object to standard output. In an Agent environment, stdout may be captured in execution transcripts, orchestration logs, debugging records, or terminal scrollback. The documentation then recommends embedding the key directly in shell commands and startup files. This creates additional copies in shell history, dotfiles, backups, process environments, and configuration-management snapshots. Generating an API key is necessary for authenticated functionality, but exposing it through general stdout ...[truncated 1237 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/onboarding.py:164
Finding: Unpinned Runtime Dependency Installation Guidance
Content: View full analysis
None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The script does not automatically install packages, but it instructs users to install `qrcode`, `pillow`, and `requests` without pinned versions, hashes, a lockfile, or a verified package source. A bare `pip install` resolves mutable package versions at installation time. This weakens reproducibility and exposes users to future compromised releases, dependency-resolution changes, or package-index manipulation. Package installation can execute package-controlled build and installation logic under the privileges of the invoking user. This is a supply-chain hardening issue rather than evidence that the named packages are currently malicious. ### Attack Path 1. The onboarding script encounters a missing dependency. 2. It instructs the user to run an unpinned `pip install` command. 3. The package installer resolves the latest available package and transitive dependencies from its configured index. 4. A compromised release, malicious index mirror, or future dependency substitution is selected. 5. Installation or import executes attacker-controlled package code with the user's privileges. 6. That code can access the same local files, environment variables, and credentials available to the Python process. ### Impact Assessment If the dependency supply chain is compromised, arbitrary code may execute ...[truncated 342 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The request sent to urlopen includes a gateway URL and multiple headers sourced directly from environment variables, including the base endpoint override via LINKFOX_TOOL_GATEWAY and session metadata headers. In an agent/runtime setting, environment variables are often externally influenced; allowing them to control outbound destinations and transmitted metadata can cause SSRF-style redirection, credential leakage, or exfiltration of conversation/session identifiers to an attacker-controlled server.
Content: Scanner excerpt · scripts/junglescout_product_database.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token requests via requests.post. If an attacker can influence the environment, they can redirect these calls to attacker-controlled infrastructure and exfiltrate credentials or session material; this is especially dangerous because the file's purpose is onboarding and token issuance, so the transmitted data is highly sensitive.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: The gateway URL is derived from environment variables and used in urllib.request.urlopen with the Authorization header set from the API key. An attacker who can tamper with the environment can redirect authenticated gateway calls, capturing the API key and manipulating package, order, or account responses, which can lead to credential theft and fraudulent transactions.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is Amazon product filtering, but the analyzed behavior reportedly includes login, SMS verification, API key management, account lookup, subscription ordering, payment QR generation, and payment-status polling. That mismatch is dangerous because it can trick the agent or user into authorizing credential handling, account actions, or purchases under the guise of a benign research tool.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
}

text
## Display Rules 1. **Table format**: Present results in a structured table with key columns: title, brand, price, monthly sales, monthly revenue, BSR rank, reviews, rating, LQS 2. **Sorting note**: Remind the user what sorting was applied and how many results were returned

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The onboarding document introduces account recovery, phone-based registration, and payment flows that are outside the declared scope of a Jungle Scout product-database filtering skill. This scope expansion increases the attack surface by enabling collection of credentials, phone numbers, and payment interactions through the skill, which could be abused or socially engineered if invoked inappropriately.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill describes a phone-number and SMS-code registration/login flow that is not justified by the advertised product-research purpose. That creates unnecessary handling of sensitive personal data and authentication factors, exposing users to privacy risks, account abuse, or phishing-style collection of login information through the agent workflow.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The billing instructions enable plan listing, order creation, and payment-method selection, which are unrelated to the skill's stated product filtering role. Embedding payment flows in a loosely related skill increases the chance of unauthorized purchases, social engineering, and user confusion about what the skill is permitted to do.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implemented functionality is unrelated to the declared Jungle Scout product-database filtering skill and instead performs account onboarding, SMS authentication, API key retrieval, and purchasing flows. This capability mismatch is a strong indicator of deceptive or unauthorized behavior because it can harvest credentials and monetize users under the guise of a benign research skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes package listing, order creation, and payment QR generation even though those actions are unnecessary for product discovery/filtering. In this context, adding payment collection logic materially increases user risk because the skill can drive users into unintended purchases and exposes them to payment fraud or abuse under misleading functionality.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares capabilities that imply environment access, file writes, and network use, but it does not constrain them with an explicit tool scope. In an agent setting, this weakens least-privilege controls and makes it easier for hidden or future instructions to perform broader actions than users would expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are very broad and allow the skill to activate for generic product-research or product-finding requests even when the user did not ask for Jungle Scout or this vendor workflow. Over-broad invocation increases the chance of unintended tool use, unnecessary external API calls, and disclosure of user queries to third-party services.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires writing every full API response to a session-linked file in the current project directory. Persisting full responses by default expands the exposure window for potentially sensitive business data, user inputs, account-related metadata, or third-party response contents beyond the immediate task context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The boundary guidance relies on broad everyday phrases like '选品', '找产品', or '市场调研' without sufficient limiting conditions. In practice, this can cause the skill to capture ambiguous requests and route user data into this tool when another skill, or no tool at all, would be more appropriate.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to automatically send feedback or mismatch reports to an external Feedback API, which is outside the core product-query task. This creates an unrequested data egress path that may transmit user content, complaints, or contextual details to a third party without clear notice or consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 171)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/tool-jungle-scout/product-database/query \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file for a product-database query skill also documents a separate public feedback API, which is unrelated to the core product filtering function. Mixing an auxiliary write-capable endpoint into operational API docs increases the chance that an agent will invoke it unexpectedly, potentially transmitting user content or conversation-derived data to a third party without a clear user request or consent boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The flow asks the user to provide a phone number to a script and complete SMS verification without any privacy notice or explanation of how personal data is transmitted, stored, or retained. This omission can lead users to share sensitive personal information without informed consent and creates avoidable privacy/compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions tell users to persist an API key in shell startup files, which stores the secret on disk in plaintext and may expose it to other local users, backups, logs, or accidental disclosure. The absence of any warning or safer alternative makes credential leakage more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This Python file contains natural-language documentation and output policy entirely in Chinese, establishing the skill's interface and behavior in a single language. The policy requires flagging language or locale constraints when they are imposed without user opt-in or an explicit justified regional scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module documentation promises that data will not be written to /tmp and that unwritable current directories will cause an error, but the implementation silently falls back to other locations including the system temporary directory. This discrepancy can cause sensitive API responses and session metadata to be persisted in less controlled locations than operators expect, weakening data-handling guarantees and potentially exposing data to other local users or cleanup tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The QR rendering function writes payment-related QR images to disk in workspace, home, or temp directories without clear user notice or lifecycle controls. While not as severe as credential theft, this can leave sensitive payment artifacts accessible to other local users or later processes, especially on shared systems.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code only accepts 11-digit phone numbers and always sends SMS login requests with areaCode set to +86, which forces a specific locale/workflow. There is no natural-language opt-in or documented justification in this file that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.