卖大律 产品侵权 TRO 风险检测

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.2

Overview

The skill does the advertised product infringement check, but it also bundles account login, API-key setup, payment ordering, public image upload, and persistent logging that need careful review before installation.

Install only if you trust LinkFox with product images, descriptions, phone-based account onboarding, API keys, and billing actions. Prefer using the official LinkFox site for signup/payment, confirm before uploading local or proprietary images, and avoid storing API keys in shell profiles on shared machines. Review or disable the automatic full-response logging and feedback reporting if the workspace may contain sensitive business or legal data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code allows network destinations to be overridden via environment variables and then sends sensitive onboarding data and credentials to those URLs with requests.post. In this skill, those requests can carry phone numbers, SMS codes, access tokens, refresh tokens, and API-token issuance traffic, so a poisoned environment can redirect secrets to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is also derived from environment variables and used in urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. If an attacker can influence the environment, API keys and subsequent account/order operations can be redirected to a hostile endpoint, enabling credential theft and unauthorized billing actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill uses environment variables, network access, and file writing without declaring those capabilities, which prevents meaningful user or platform review of what the skill can do. In this specific skill, those capabilities enable outbound transmission of user-provided images/text and persistent local storage of responses, increasing privacy and data-handling risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is infringement-risk analysis, but the skill behavior reportedly also includes SMS-based login, API key acquisition, package lookup, payment order creation, payment-status polling, and image upload. That mismatch is dangerous because it expands the trust boundary into account, billing, and data-upload actions users may not reasonably expect from a legal-risk analysis skill.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The onboarding content introduces phone-based registration, login, API key setup, and billing/payment flows that are unrelated to the skill’s declared TRO/IP risk analysis purpose. This expands the skill’s effective scope into credential handling and payment guidance, creating opportunities for social engineering, improper collection of user data, and unsafe operator behavior if the documentation is followed blindly.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file content materially diverges from the skill’s stated TRO/IP infringement-analysis function and instead documents operational recovery for authentication and billing. This mismatch can mislead users or host agents into performing sensitive, unrelated actions, weakening the principle of least privilege and making abuse or misconfiguration harder to detect.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module documentation promises that output is always written under the current working directory and forbids /tmp, but the implementation explicitly falls back to ~/linkfox and the system temp directory. This mismatch can cause sensitive infringement-analysis responses to be stored in less expected or less controlled locations, increasing risk of unintended disclosure and breaking operator assumptions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API-key retrieval, plan listing, ordering, and payment QR generation rather than TRO/IP-risk detection described by the skill metadata. That mismatch is dangerous because it expands the skill into credential collection and commerce flows unrelated to the declared purpose, increasing the chance of deceptive data capture and unauthorized monetization.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create orders against backend APIs and render payment QR codes, which is unrelated to assessing infringement risk from product images. In the context of a legal-risk detection skill, hidden billing capabilities are especially concerning because they can induce purchases or facilitate unauthorized charges under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script performs SMS-based login, fetches user/team information, and obtains or generates API tokens, none of which is justified by the stated detection-only purpose. In this context, collecting verification codes and minting API keys creates a strong risk of credential harvesting and account takeover functionality embedded inside an unrelated skill.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The helper uploads local images to public storage and returns a publicly accessible URL, but this data exposure behavior is not clearly reflected in the skill's stated TRO/IP assessment scope. In a skill handling potentially sensitive product images, undisclosed public publication can create confidentiality, privacy, and compliance risk for users who may assume analysis occurs without broad external sharing.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to activate on many generic image-and-risk requests, which can cause the skill to run and send data externally when the user did not specifically intend to use this paid third-party analysis flow. The risk is amplified here because the tool is costly and processes product images and text through an outside service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description does not clearly warn users that product images, reference images, descriptions, and keywords are sent to an external API for analysis. This omission undermines informed consent and may expose confidential product designs, seller data, or other sensitive business information to third parties.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API documentation instructs the agent to send product images, image URLs, Base64 image data, and descriptive text to external LinkFox endpoints, but it does not require an explicit user-facing disclosure or consent step before transmitting potentially sensitive data. In this skill context, users may upload proprietary product images, unreleased designs, or third-party marketplace content, so silent forwarding to a remote service creates a real privacy and confidentiality risk even if the endpoint itself is legitimate.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs collection of a user’s phone number and use of SMS verification for registration/login without any privacy notice, retention guidance, or safe handling expectations. Even if legitimate, collecting personal data in an undeclared flow increases privacy and phishing risk and may cause users to disclose sensitive information to an untrusted channel.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation tells users to persist API keys in shell profile files using export commands, but gives no warning about credential exposure, local file modification, shell history leakage, or multi-user machine risks. Persisting secrets this way may be acceptable in some environments, but presenting it without safeguards can lead to accidental disclosure or insecure workstation configuration.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script always persists the full API response to disk, and the response may contain product images, infringement indicators, legal assessment output, and case-related metadata. Silent persistence of potentially sensitive business/legal data increases confidentiality risk, especially in shared workspaces or on hosts with broad filesystem access.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The request sends SESSION_ID, MODE_ID, and APP_NAME from environment variables to the remote service without any disclosure or minimization. While this may be intended for session correlation, it can leak internal workflow or user context to the external API and broaden the data shared beyond what is necessary for TRO detection.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs persistent logging of full tool responses into session-organized files under the working directory, which can retain user-provided images, legal assessments, identifiers, and other sensitive business data beyond the immediate task. Persistent local artifacts increase exposure to later unauthorized access, accidental commits, workspace sharing, or reuse across tasks.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The automatic feedback-reporting instruction encourages sending user interactions, including satisfaction/dissatisfaction and improvement opportunities, to another API without interrupting the user flow. This creates a secondary data exfiltration channel for user content unrelated to the primary TRO analysis purpose and bypasses meaningful user consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This code transmits sensitive user and authentication data to external services during login and token workflows. External transmission is expected for legitimate APIs, but here it becomes risky because the skill's declared purpose does not justify credential-handling flows and the destinations are partially environment-configurable.

Static analysis

No suspicious patterns detected.