美客多选品数据

• Outcome: Review
• Latest audit: Aug 18, 2026 · 11:54 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches a paid Mercado Libre analytics tool, but it also includes sensitive account onboarding, API-key provisioning, payment-order creation, and broader local persistence than advertised.

Install only if you are comfortable letting this skill use LinkFox account credentials, send onboarding and billing data to LinkFox services, create payment orders when directed, and save full query responses locally. Prefer self-service API-key setup, review environment variables before use, and avoid running it in shared or repository workspaces if the returned business data is sensitive.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code builds POST destinations from environment-configurable base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence environment variables, they can redirect authentication traffic and credentials to an arbitrary server, effectively turning this onboarding script into an exfiltration channel.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request path uses an environment-derived base URL together with the bearer API key from environment variables, then transmits it via urlopen in the Authorization header. An attacker who controls the environment can repoint the gateway to a malicious endpoint and capture the API key and subsequent account, package, and order data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs the agent to use environment variables, make network calls, and persist responses to local files, yet no explicit permission declaration is present. This creates a transparency and policy gap: users and the host system may not realize the skill can exfiltrate data over the network or leave local artifacts containing retrieved content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a Mercado Libre analytics/query tool, but the referenced onboarding and payment flows imply account login, SMS verification, API key handling, package purchase, and payment-status operations outside the declared scope. That mismatch is dangerous because users may invoke what appears to be a read-only research skill while it guides or enables sensitive account and billing actions.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documentation adds a separate Feedback API that is outside the skill’s declared Mercado product-selection/query scope. Even though it is not inherently malicious, undocumented or scope-expanding network actions can enable unintended data exfiltration or unreviewed outbound communication if an agent starts sending user content to a second service.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to home and temporary directories. This mismatch can cause sensitive API data to be persisted in less protected locations than operators expect, undermining security assumptions and incident response.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements account onboarding, SMS login, API-key issuance, package listing, order creation, and payment status queries, which materially exceed the declared scope of a Mercado Libre product-selection analytics skill. Scope expansion is dangerous because it introduces credential handling and billing behavior users and reviewers would not expect from an analytics tool.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill includes package purchase and payment-order creation logic, including rendering payment QR codes, despite the advertised purpose being product-selection/query analysis. Unexpected billing capability can be abused for unauthorized purchases or social-engineering users into payments under the guise of analytics features.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code logs users in via SMS, calls user-info endpoints, and retrieves or generates API tokens for LinkFox accounts, which is unrelated to Mercado Libre analytics. This grants the skill the ability to provision long-lived credentials, increasing the blast radius from simple data lookup to account takeover or persistent API access if abused.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that it always writes full responses to project-local files, but this persistence is not surfaced as a prominent consent or privacy warning to the user. Because responses may include user-supplied search terms, account usage details, or other business data, automatic local retention increases the risk of unintended disclosure to other tools, users, or repository processes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions direct the agent to request and process a user's phone number for registration, but provide no privacy notice, consent language, retention limits, or handling safeguards for that personal data. In an onboarding flow, this creates unnecessary privacy and compliance risk because users may be induced to disclose sensitive contact data without understanding why it is needed or how it will be used.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script always writes the full API response to local disk, including potentially sensitive business data, without requiring user confirmation or providing a clear runtime disclosure. In this skill context, responses may include product, store, keyword, usage, or account-related data, so unconditional persistence increases exposure through local compromise, backups, or shared workspaces.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code transmits SESSION_ID, MODE_ID, and APP_NAME from the environment in outbound HTTP headers without explicit user disclosure or minimization. These identifiers may enable correlation of user activity, link requests across sessions, or leak internal application context to the remote service beyond what is necessary for the query.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The script writes payment QR code images to disk in a session directory without any clear warning or lifecycle control. Persisting payment artifacts locally can expose transaction links to other local users, backups, or later processes, especially when the directory may fall back to shared or temporary locations.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Mandating persistent logging of full tool responses to project-local files creates a durable data-leak surface, especially in shared workspaces, synced folders, repositories, or environments where later prompts can inspect those files. The danger is amplified by instructions to aggregate by session and by the possibility that responses contain commercially sensitive results, usage information, or user-derived inputs.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This is a real external transmission of sensitive onboarding data to remote services, including phone numbers, SMS codes, tokens, and account metadata. In this skill context, the transmission is more dangerous because the skill is presented as analytics-focused, not as an account/login broker, so users and reviewers may not expect credential-bearing network activity.

Static analysis

No suspicious patterns detected.