Security audit

Keepa-商品详情

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised ASIN product lookup, but it also includes under-scoped account login, API-key, payment, persistent storage, and automatic feedback-reporting behavior that users should review carefully before installing.

Install only if you are comfortable with LinkFox handling product queries, account onboarding data, API credentials, billing actions, local response files, and automatic feedback submissions. Avoid using the phone/SMS login or payment flows through an agent unless you explicitly intend to, rotate any API key printed in transcripts, and do not run with untrusted LINKFOX_* or SESSION_ID environment variables.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:158
Finding: Automatic Feedback Reporting Can Disclose User Conversation Data Without Explicit Consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/keepa_product_detail.py:34
Finding: API Credentials and Session Metadata Can Be Sent to an Environment-Controlled Destination
Content: View full analysis
str: """网关基础地址：env LINKFOX_TOOL_GATEWAY 优先，缺省回退正式地址。""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def get_api_key(): key = ( os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") ) if not key: print("API Key 未配置", file=sys.stderr) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis The script reads a privileged API credential and attaches it to a request whose origin is taken directly from `LINKFOX_TOOL_GATEWAY`. The value is not constrained to the documented LinkFox HTTPS host, and the code does not reject: - Untruste ...[truncated 1705 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:62
Finding: Onboarding Endpoint Overrides Can Exfiltrate Phone Numbers, Verification Codes, and Authentication Tokens
Content: View full analysis
str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com", ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` The login helper sends request bodies to the configurable login origin: ```python def _login_post(path: str, body: dict) -> dict: return _http_post( f"{_login_base()}{path}", body, _headers( "ai-linkfox-web", "ai.linkfox.com", access_token="", ), ) ``` Phone numbers and SMS verification codes are included in those request bodies: ```python def send_verify_code(phone: str) -> dict: resp = _login_post("/user/v1/web/login", { "type": "sms", "method": "getVerifyCode", "data": { "authPhone": phone, "areaCode": "+86", "clientChannel": "LinkFoxAgent", }, }) ``` ```python def _login_v3(phone: str, code: str, channel: str) -> dict: resp = _login_post("/user/v3/web/login", { "type": "sms", "method": "login", "systemId": "LinkFoxAgent", "data": { "areaCode": "+86", "authPhone": phone, "authCode": code, "sourceChannel": channel or "skill", }, }) ``` Access and refresh tokens are subsequently sent to another configurable origin: ```p ...[truncated 3487 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:486
Finding: Generated API Key Is Printed in Plaintext to Standard Output
Content: View full analysis
dict: # ... tok = _get_or_generate_api_token( lg["access_token"], lg["user_id"], info["group_id"], ) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The complete object is then serialized to standard output: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print( f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr, ) return 0 ``` ### Technical Analysis Standard output is not a secure credential-delivery channel. In agent and automation environments, stdout is commonly: - Added to conversation transcripts. - Captured in tool-call logs. - Persisted by CI systems. - Copied into debugging telemetry. - Visible to parent processes or terminal recording systems. - Retained longer than the credential itself. The implementation prints the complete reusable API key instead of returning a masked value or writing it to a protected credential store. The onboarding documentation also directs the key to be inserted into shell commands, increasing the chance of shell-history ...[truncated 990 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/keepa_product_detail.py:178
Finding: Unsanitized Session Identifier Enables Output-Directory Traversal and Unsafe Temporary Storage
Content: View full analysis
str: candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) import tempfile candidates.append( os.path.join(tempfile.gettempdir(), "linkfox") ) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _SESSION_CACHE["_root"] = root return root ``` The session identifier is accepted without validation and used directly as a path component: ```python def _session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The resolved dire ...[truncated 2929 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (30)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The request destination and outbound headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY and session-related header values. In an agent/runtime context, environment configuration is often less trusted than hardcoded values; this can enable server-side request forgery or credential/token exfiltration by redirecting requests to an attacker-controlled endpoint while sending the API key in the Authorization header.
Content: Scanner excerpt · scripts/keepa_product_detail.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The code sends authentication tokens, SMS-login data, and API-key workflow traffic to base URLs that can be overridden via environment variables. In an agent/runtime environment where env vars may be influenced by operators, wrappers, or other components, this can redirect sensitive credentials to attacker-controlled endpoints and enable SSRF-style outbound requests.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: Gateway requests use a URL derived from environment-controlled base paths and attach the LinkFox API key in the Authorization header. If the base URL is tampered with, the skill can exfiltrate secrets to an attacker-controlled server while also enabling arbitrary outbound requests from the host environment.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The static finding indicates the skill behavior extends into authentication, API key generation, account/team info access, billing plans, order creation, payment QR generation, and payment-status checks, none of which are disclosed by the stated ASIN lookup purpose. If accurate, this is a major privilege and trust boundary violation because a product-data skill would implicitly gain access to account and payment workflows unrelated to the user's request.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The static finding indicates the skill behavior extends into authentication, API key generation, account/team info access, billing plans, order creation, payment QR generation, and payment-status checks, none of which are disclosed by the stated ASIN lookup purpose. If accurate, this is a major privilege and trust boundary violation because a product-data skill would implicitly gain access to account and payment workflows unrelated to the user's request.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
- **响应401或402状态码** - **响应提示算力或余额不足**：消息含"算力余额不足/计费不足/余额不足/quota exceeded/insufficient balance/套餐到期/需充值/请充值"，或类似含义的内容。 ## Display Rules 1. **Present data clearly**: Show product details in well-structured tables. Group related fields (e.g., dimensions together, sales data together) for readability. 2. **Price and currency**: Always display the price alongside its currency (e.g., "$29.99 USD"). The `currency` field in the response indicates the local currency.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module documentation says writing to /tmp is forbidden and that failure to write to the current directory should error out, but the implementation silently falls back to home and temporary directories. This mismatch is security-relevant because operators may rely on the documented guarantee when assessing data handling, yet the code can still write sensitive response data to less controlled locations, creating unintended disclosure risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements account onboarding, SMS verification, login, API-key issuance, subscription listing, and order/payment flows rather than ASIN product-detail retrieval described by the skill metadata. This mismatch is dangerous because it expands the skill into credential collection and account monetization capabilities that users and reviewers would not reasonably expect.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill can create purchase orders and render payment QR codes even though its stated purpose is ASIN product lookup. Embedding billing operations in an unrelated skill materially increases the risk of unauthorized purchases, deceptive flows, and abuse of the agent as a payment facilitator.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill performs SMS-based authentication, retrieves user/team information, and generates API tokens, none of which are necessary for fetching Amazon product details by ASIN. This creates a direct credential-harvesting and secret-provisioning path under misleading functionality, raising the risk of account compromise and abuse.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares capabilities that involve environment access, file writes, and network use, but it does not explicitly scope or constrain those tools via permissions/allowed-tools. This weakens least-privilege controls and makes it easier for the skill to access secrets, persist data, or make outbound calls beyond what a user would reasonably expect from an ASIN lookup skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requires writing complete API responses into persistent, session-organized project directories, which can retain user-provided identifiers, product research activity, and possibly account-related metadata beyond the immediate task. Persistent storage increases the blast radius of later compromise, accidental sharing, repository inclusion, or cross-task data exposure.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Automatic feedback reporting triggered by user reactions or mismatches risks transmitting user content, task context, or behavioral metadata to another API without clear data minimization or consent boundaries. Even if intended for quality improvement, silent exfiltration of conversational details can violate privacy expectations and leak commercially sensitive research requests.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 126)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/keepa/productRequest \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file for an Amazon product-details skill includes a separate feedback-submission API that is unrelated to the declared core function. In an agent setting, this creates an unexpected side-effect channel that could cause user content or task context to be transmitted to a third-party endpoint without clear necessity or consent, increasing the risk of data leakage and prompt-driven misuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The onboarding document introduces authentication recovery, account registration, and billing/payment workflows that are outside the declared purpose of an ASIN product-detail lookup skill. This broadens the skill’s operational scope into credential handling and payments, increasing the chance an agent will collect sensitive data or trigger higher-risk actions not justified by the manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions tell the agent to collect a user’s phone number and use it with a script-based send-code/login flow, even though phone-based identity operations are unnecessary for product-information retrieval. This creates unjustified handling of sensitive personal data and authentication tokens, and could enable account takeover or privacy violations if misused or exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The markdown directs collection of the user’s phone number for registration and login without any explicit privacy notice, data-minimization guidance, or warning about handling one-time codes. In the context of a product lookup skill, this is especially dangerous because users would not reasonably expect sensitive identity data collection, making phishing-like misuse more plausible.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs the agent to list subscription plans, create orders, and guide payment-method selection, which exceeds the purpose of a product-detail lookup skill. Embedding purchase flows in an unrelated skill raises the risk of unauthorized charging guidance, social-engineering abuse, and unsafe handling of commercial transactions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The top-level docstring, usage notes, and output policy are written entirely in Chinese, which imposes a specific language expectation on users. There is no indication that the skill is region-specific or that users can opt into another language, so this appears to violate the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script persistently stores full API responses, cache entries, and session metadata to local disk, including under fallback locations such as the home directory and temp directory. Product-detail responses and associated session metadata may contain sensitive business data, identifiers, or usage traces, and the persistence behavior exceeds the core lookup function described by the skill, increasing data exposure and retention risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring openly describes an onboarding/account CLI, which contradicts the manifest’s ASIN-detail claim. This discrepancy is a strong indicator of deceptive packaging: reviewers and users may invoke the skill expecting product data while actually exposing phone numbers, SMS codes, and payment actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: The function transmits sensitive onboarding and login data to external services over the network. External transmission is expected for an API client, but in this skill it becomes security-relevant because the destinations are partially environment-configurable and the transmitted data includes credentials and tokens.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The onboarding flow only accepts 11-digit phone numbers and always submits areaCode '+86', while command help also describes only domestic phone numbers. This enforces a specific locale/language-region behavior without opt-in or documented justification in the file, matching the language/locale policy concern.
Content: No source excerpt is available for this finding.