Jungle Scout-销量预估

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 1.0.7

Overview

The skill can do the advertised sales-estimate lookup, but it also handles login, API keys, billing orders, automatic feedback reporting, and persistent local storage in ways users should review first.

Install only if you are comfortable with LinkFox account onboarding inside the skill, including phone/SMS login, API-key generation, billing order creation, and saving full query responses locally. Prefer self-service API-key setup, avoid overriding LinkFox endpoint environment variables, keep generated keys out of logs, and review or delete the local linkfox data/cache directories after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target is derived from environment-controlled base URLs, so a modified runtime environment can redirect login or token-bearing requests to an attacker-controlled endpoint. Because these requests may carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this creates a real credential exfiltration and SSRF-style risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request URL is built from environment-controlled base URLs and then used in urlopen with the API key in the Authorization header. If an attacker can influence environment variables, they can redirect these requests and capture the API key or force requests to internal/untrusted services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill describes and enables access to environment variables, network calls, and persistent file writes, but no explicit permission model or declaration is present. That creates a trust and review gap: operators and users cannot easily tell that the skill can read secrets, call external services, and store data locally, which increases the chance of unintended data exposure or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose is sales-estimate lookup, but the referenced behavior extends into SMS verification, account login, API-key retrieval/generation, subscription purchase, payment QR rendering, and order-status queries. This is dangerous because it expands the skill from a bounded data query into authentication and billing workflows, creating opportunities for credential handling, account takeover risk, unexpected charges, and confused-deputy behavior outside user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documentation adds a separate feedback-submission API that is outside the skill's primary sales-estimate lookup function, creating an unexpected outbound data path. In an agent setting, this can cause user content, operational details, or conversation-derived text to be sent to an external service without clear necessity or tightly scoped triggering conditions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as a query tool, but it persistently writes full API responses and session metadata to local storage. That creates an unnecessary data-at-rest footprint for potentially sensitive business intelligence, increasing exposure through local compromise, accidental inclusion in project artifacts, or later exfiltration by other tools.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The cache layer and session-artifact framework expand the skill from a simple API fetcher into a local data collection and tracking mechanism. Persisting structured caches and metadata across runs can expose prior queries, session identifiers, and accumulated commercial data beyond the immediate user request.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that a non-writable current directory should cause failure, but the implementation silently falls back to the home directory and temporary directory. This mismatch undermines operator expectations and can cause sensitive responses to be stored in locations with weaker controls or broader accessibility than intended.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The comment states that small responses are output directly without file persistence, but the code writes the full response to disk before deciding whether to print inline. This is dangerous because users or reviewers may rely on the documented behavior and unknowingly expose sensitive response data to local storage.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements onboarding, login, API key issuance, plan listing, ordering, and payment QR generation, which is unrelated to the declared ASIN sales-estimate skill. That mismatch is dangerous because it expands capability into account and billing operations that a user invoking a data-query skill would not reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing and payment-order creation are not justified by the skill's stated purpose and enable direct financial workflow execution. In the context of a sales-estimate lookup skill, this is especially risky because it can trigger purchases or payment prompts under a misleading functional label.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: SMS-based authentication, user info retrieval, and API token generation go far beyond a read-oriented ASIN query role. This is dangerous because it collects credentials and creates long-lived access material, increasing the chance of account compromise or misuse if invoked under the guise of a simple analytics skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The feedback section instructs sending free-form content to an external endpoint but does not warn that the content leaves the local system or may contain user-provided text. This increases the risk of inadvertent exfiltration of sensitive prompts, user data, or internal tool results because an agent may treat the action as routine skill behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The onboarding instructions explicitly tell the operator to collect a user's phone number and use it for script-driven registration, but they provide no privacy notice, consent language, retention limits, or handling safeguards. This creates a real privacy and compliance risk because sensitive personal data may be solicited and processed through an ad hoc workflow without clear disclosure or minimization.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script always stores full API responses and session metadata locally without any explicit runtime warning or user confirmation. For a sales-estimate query skill, this hidden persistence can leak proprietary market research, pricing information, and user activity history to disk where it may be retained or accessed later.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The generated API key is emitted in stdout JSON, which is commonly captured by logs, orchestration layers, chat transcripts, and debugging tooling. Exposing credentials this way can lead to unintended retention and reuse by anyone with access to those outputs.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill instructs persistent storage of full tool responses in session-scoped files under the working directory, rather than limiting retention to the immediate response. Even if the current payload is mostly sales data, responses can still contain user-supplied identifiers, account-related error details, usage metadata, or other sensitive context, and writing them to project-accessible storage increases the chance of later leakage, cross-task exposure, or unintended inclusion in version control.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.