Keepa-商品历史数据

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.6

Overview

The skill's Amazon product-history function is real, but it also handles LinkFox login, API key generation, billing orders, and persistent local storage, so it needs user review before installation.

Install only if you are comfortable letting this skill use LinkFox network services, read a LinkFox API key from the environment, help create or retrieve LinkFox account credentials, initiate paid plan orders when credits are insufficient, and store full responses or payment QR artifacts locally. Avoid using it in shared workspaces or with untrusted environment variables unless the storage paths and gateway URLs are controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent to urlopen includes attacker-influenced environment data in headers and, more importantly, allows the destination base URL to be overridden via LINKFOX_TOOL_GATEWAY. In an agent runtime, this can exfiltrate the API key and session identifiers to an arbitrary host and turns the tool into an SSRF-style outbound request primitive.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication data, including SMS login payloads, access tokens, refresh tokens, and generated API keys, to those endpoints. In an agent or multi-tenant runtime, environment variables can be influenced by the host or adjacent tooling, turning this into credential exfiltration or SSRF with very little friction.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway request path uses an environment-derived base URL and automatically attaches the API key in the Authorization header before calling urlopen. If the environment variable is tampered with, the skill will transmit the user's API key and order/account queries to an attacker-controlled server, which is especially dangerous because this file also supports billing and account operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions while instructing use of environment variables, network APIs, and persistent file writes. This creates a transparency and consent gap: operators may invoke a skill believing it is low-privilege when it can access credentials and store data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is ASIN historical analytics, but the instructions reference onboarding and billing/account flows including login, API key retrieval, plan purchase, payment QR generation, and order status checks. Expanding from product analytics into authentication and payment operations materially increases the attack surface and can expose users to credential handling and unintended financial actions outside the declared scope.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script persistently stores full API responses, cache contents, and session metadata to local files under linkfox/, which goes beyond a simple query tool and can retain potentially sensitive commercial data, identifiers, and usage metadata. In agent environments, silent persistence increases the risk of unintended data retention, later disclosure to other tools/users, and privacy boundary violations.

Intent-Code Divergence

High

• Confidence: 90% confidence
• Finding: The docstring explicitly says writing to /tmp is forbidden and a non-writable current directory should cause failure, but the implementation falls back to ~/linkfox and then the temporary directory. This mismatch is dangerous because operators may rely on the documented no-/tmp behavior, while the code actually writes responses and metadata into less controlled locations, increasing accidental exposure.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This skill is described as an Amazon historical product-series query tool, but the code is an onboarding and commerce CLI for LinkFox account login, API key acquisition, package listing, order creation, and payment QR generation. That mismatch is a strong indicator of hidden functionality and materially increases risk because users invoking a data-query skill would not reasonably expect account provisioning and monetization flows.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code includes order creation, payment method selection, payment URL/QR handling, and order-state queries even though the skill's advertised purpose is querying Amazon product history. Billing logic inside an unrelated data-retrieval skill can be abused to initiate purchases or pressure users into payments under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file performs SMS-based login, token exchange, user/team discovery, and API token generation, which goes far beyond the stated product-data lookup purpose. In context, this allows the skill to collect phone numbers and verification codes and mint reusable API credentials, creating a significant account-takeover and secret-harvesting risk.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The trigger language is very broad and can match generic product-research or competitor-analysis requests, causing the skill to run when the user's intent is ambiguous. In this skill's context, over-triggering is risky because each call can consume paid tokens and may initiate persistent logging of returned data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs operators to collect and pass a user's phone number into a script-based registration flow, but it does not include any privacy notice, consent guidance, data handling limits, or retention/deletion expectations. This creates a real privacy and compliance risk because personally identifiable information is being solicited and processed through an operational workflow without safeguards or disclosure.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The order command renders and stores payment QR images on disk automatically in a writable session directory without an explicit confirmation at the write point. This can leave payment artifacts behind on shared systems or workspaces, exposing purchase links or transaction metadata to other local users or later processes.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill instructs persistent storage of full tool responses in session-scoped files under the working directory by default. Even if the intended data is product analytics, full responses can include user-supplied identifiers, account metadata, cost information, or other sensitive context, increasing exposure through local retention, accidental commit, or cross-task access.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.