Keepa-商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:42 PM UTC
• Version: 1.0.6

Overview

This skill is a real LinkFox/Keepa product-search integration, but it bundles broad activation, account/SMS onboarding, API-token generation, payment flows, automatic feedback reporting, and persistent local storage that require careful review before installation.

Install only if you intend to use LinkFox as a paid, account-backed Keepa search provider and are comfortable with the agent helping configure API keys, handling SMS onboarding, showing payment QR codes, sending feedback to LinkFox, and saving full search responses locally. Prefer self-service API-key setup, confirm before any credit-consuming search or purchase step, and review/delete the generated linkfox files when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target is ultimately derived from environment-controlled base URLs, and this function transmits sensitive login data and tokens to that destination. In a skill context, allowing unvalidated environment overrides for authentication endpoints can exfiltrate SMS codes, access tokens, refresh tokens, and generated API keys to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The gateway request URL is built from environment-controlled base URLs and includes the LinkFox API key in the Authorization header. If an attacker can influence environment variables, requests can be redirected to an arbitrary server and the API key plus account/order metadata will be disclosed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require reading environment variables, making network requests, and writing files. This mismatch weakens review and user consent because the skill can access credentials and persist data without an explicit permission model, increasing the chance of unintended data exposure or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is product search, but the embedded behavior extends into account login, API key generation, package purchase, recharge, QR-code payment, and payment-status polling. That is a major scope expansion into credential handling and financial operations, which can surprise users, trigger unauthorized transactions, or collect sensitive account data under the guise of search functionality.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs automatic feedback reporting whenever the model believes something could be improved or when the user expresses praise or dissatisfaction. This creates an undisclosed outbound data flow unrelated to the core search task and may transmit user content or behavioral signals to another API without clear consent or necessity.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The API reference for a product-search skill documents an additional public feedback-submission endpoint that is operationally unrelated to the primary search capability. This expands the skill's reachable action surface and could let an agent send externally visible data to a second service without the user's clear intent, creating a risk of unintended data exfiltration, spam, or off-target side effects.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill creates a durable local data store for API responses, session metadata, and indexes that goes beyond what is necessary for a simple product-search action. Because search parameters and returned data may contain commercially sensitive queries, identifiers, or account-linked metadata, this persistence increases exposure through unintended retention, later reuse, or leakage from shared workspaces.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS login, API-key retrieval, package listing, order creation, and payment QR generation, which are unrelated to the declared Keepa/Amazon product-search functionality. Such scope divergence is dangerous because it solicits user credentials and payment actions far beyond the manifest, increasing the chance of credential harvesting and unauthorized monetization.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can obtain or generate an API token for the user's LinkFox account after SMS-based login. In the context of a product-search skill, generating persistent credentials is highly dangerous because it can grant ongoing access to the user's account and downstream services without being justified by the stated functionality.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code includes subscription/package discovery, order creation, and payment QR generation, none of which are necessary for Amazon product filtering. Embedding purchase flows in an unrelated skill creates risk of deceptive billing, coerced upgrades, and collection of account/payment metadata under false pretenses.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The activation criteria are broad enough to match generic product-research requests even when the user did not ask for Keepa or this provider specifically. Over-broad triggering can route unrelated requests into a costly, data-collecting, or side-effecting workflow, especially dangerous here because the skill can invoke networked services, persistent storage, and onboarding/payment flows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs operators to collect and process a user's phone number through a script-driven registration flow without any notice about consent, storage, retention, masking, or transmission safeguards. In a support/onboarding context, this creates a real privacy and social-engineering risk because sensitive personal data is being solicited and handled operationally with no documented controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code always writes the full API response to disk before deciding whether to print it, with no explicit consent or warning at the write site. If the response includes sensitive business data, account-linked metadata, or user-supplied search criteria, that data is silently retained on local storage and may be accessible to other users or later processes.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill requires writing complete API responses into session-scoped files under the current project directory and forbids ephemeral storage. Persistent storage of full responses increases retention of potentially sensitive business data, search criteria, and account-related error content, and placing it in the working directory raises the risk of accidental inclusion in repositories, sharing, or access by other tools and users.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 84% confidence
• Finding: This code transmits user-supplied phone numbers, SMS codes, tokens, and account metadata to external services. External transmission alone is expected for networked functionality, but in this case it becomes dangerous because the destination can be environment-controlled and the skill's declared purpose does not justify handling these sensitive authentication artifacts.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.