ClawHub
Back to skill

Security audit

Keepa-商品详情

Security checks across malware telemetry and agentic risk

Overview

This ASIN lookup skill is mostly coherent, but it also includes account login, API-key generation, payment flows, persistent response storage, and automatic feedback reporting that users should review before installing.

Install only if you trust LinkFox with ASIN query data, API keys, phone-based onboarding, and payment setup. Before use, confirm marketplace and cost, avoid sharing OTPs or API keys in chat unless you understand the trust boundary, and disable or avoid automatic feedback reporting unless you consent to sending feedback content externally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
94% confidence
Finding
The request URL and headers are influenced by environment variables, especially LINKFOX_TOOL_GATEWAY, SESSION_ID, MODE_ID, and APP_NAME, and are then sent via urlopen. If an attacker can control the execution environment, they can redirect requests to an attacker-controlled host and exfiltrate the API key in the Authorization header along with request data and metadata. In an agent/skill context, trusting environment-provided endpoints is particularly risky because skills often run with sensitive credentials already injected.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
89% confidence
Finding
The code sends authentication material and user data to a URL built from environment-controlled base URLs via requests.post. In an agent/skill environment, environment variables are often deployment-controlled rather than user-controlled, but if they are altered or poisoned, the CLI will transmit SMS login data, access tokens, refresh tokens, and related identifiers to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
87% confidence
Finding
The gateway request path uses urlopen on a Request whose destination is derived from environment-configured base URLs and includes the API key in the Authorization header. If an attacker can influence those environment variables, they can redirect traffic and exfiltrate the agent API key or manipulate billing/account operations.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions, yet its documented behavior clearly uses environment variables, network access, and file writes. This under-disclosure prevents informed consent and weakens policy enforcement, especially because the skill also stores API responses on disk and depends on secret material from the environment. In an agent setting, hidden capabilities materially increase risk even if the core business purpose is legitimate.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill is presented as an ASIN product-detail lookup tool, but the documented behavior extends into account login via SMS, API-key acquisition, subscription/package lookup, order creation, QR-code generation, and payment-status polling. That is a major expansion from data retrieval into authentication, billing, and transaction workflows, creating risk of credential handling, unintended charges, and collection of sensitive user/account data without clear upfront disclosure. In this context, the mismatch is especially dangerous because users invoking a product-data skill would not reasonably expect payment or login side effects.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill instructs the agent to automatically report feedback through a separate API whenever various conditions apply, including broad subjective cases like anything that could be improved. This creates an undisclosed telemetry channel unrelated to the core ASIN lookup function and may transmit user content or behavioral signals without explicit consent. Because it is automatic and non-interrupting, users may have no visibility into what is being sent externally.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The file for an ASIN product-detail skill documents an additional Feedback API that is operationally separate from the declared tool purpose. This expands the skill's effective capability surface and creates a path for unrelated outbound data transmission, which can be abused to send user-derived content to a third party without being necessary for the requested product lookup.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements onboarding, login, API key acquisition, subscription management, and payment flows even though the declared skill is for Amazon ASIN product-detail retrieval. That mismatch materially increases risk because a user invoking a data lookup skill would not reasonably expect credential collection or purchasing behavior, creating opportunity for covert account and payment actions.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The order creation and payment QR generation capabilities are unrelated to ASIN lookup and enable commercial transactions from within the skill code. In the context of a product-detail skill, hidden billing functionality is especially dangerous because it can facilitate unauthorized purchases, abuse of stored credentials, or social engineering around payment flows.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The code performs SMS authentication, token exchange, user/team enumeration, and API-token generation beyond the stated purpose of product-data retrieval. In skill ecosystems, this is dangerous because it expands the blast radius from read-only product queries to account takeover-adjacent flows and secret issuance.

Vague Triggers

High
Confidence
84% confidence
Finding
The activation rule is overly broad and says the skill should trigger whenever a request could involve structured ASIN product data, even if Keepa is not mentioned. Overbroad routing can cause this skill to capture queries intended for other tools or safer/manual handling, leading to unnecessary external API calls, data persistence, and surprise costs. The danger is amplified here because the skill is paid, writes results to disk, and has additional reporting/billing-related behaviors elsewhere in the documentation.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
Defaulting silently to the US marketplace when the user omits locale can return the wrong product context, pricing, fees, dimensions, or sales information. While not a direct compromise, it can mislead users into acting on incorrect commercial data and can trigger paid requests against an unintended marketplace. In an e-commerce analysis skill, silent locale assumptions are more risky than in a low-stakes informational setting.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The feedback example encourages sending free-form content to a separate endpoint but provides no user-facing warning, consent requirement, or data-minimization guidance. Because `content` may contain user statements, intentions, or problem descriptions, this creates a realistic privacy and prompt-data exfiltration risk if an agent forwards conversational text automatically.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The guide instructs collecting a user's phone number and one-time verification code to run a login/registration script, but it provides no warning about sensitive-data handling, storage, redaction, or who is allowed to see these secrets. In an agent/workflow context, this can lead to credential exposure in chat logs, terminal history, process lists, or operator handling, enabling account takeover or privacy violations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.