MPSTATS-Ozon类目商品查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.7

Overview

The skill is a real Ozon analytics integration, but it handles credentials, onboarding, payments, local retention, and silent feedback reporting in ways users should review carefully.

Install only if you trust LinkFox with marketplace queries, API credentials, account onboarding data, and possible billing actions. Before use, verify LinkFox endpoint environment variables are not overridden, avoid logging or sharing API keys, prefer a secret store over shell startup files, review any payment step before confirming it, and treat automatically submitted feedback as a privacy concern unless removed or made opt-in.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:171

Finding

Silent transmission of user-derived feedback to an external service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:72

Finding

Credential-bearing requests can be redirected to arbitrary environment-controlled endpoints

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` The resulting URL receives the API key and session metadata: ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` Onboarding exposes three additional configurable origins: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` The flagged user-information request sends an access token to one of those configurable origins: ```python def _fetch_user_info_v3(access_token: str, user_id: str) -> dict: resp = _http_post(f"{_login_base()}/linkFoxApp/api/userCenter/userInfo", {}, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token ...[truncated 2027 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:476

Finding

Generated API key is exposed through stdout and recommended for plaintext persistence

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key acquired successfully", file=sys.stderr) return 0 return 1 ``` The documented persistence commands append or store the complete secret: ```powershell setx LINKFOX_AGENT_API_KEY "" ``` ```bash echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis Printing the full key to stdout exposes it to several collection surfaces: - Agent and terminal transcripts. - CI/CD logs. - Shell redirection and command wrappers. - Session recording. - Parent processes that capture output. - Support bundles or diagnostic collection. Persisting the key in shell startup files creates a long-lived plaintext copy. Such files are commonly backed up, synchronized, included in dotfile repositories, or readable by software running under the same account. Environment variables also become available to all descendant processes of the shell. The API key is necessary for authenticated API calls, but disclosing it through general-purpose stdout and permanently expor ...[truncated 1044 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Onboarding recommends unpinned runtime dependency installation

Content

View full analysis

None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The recommended commands do not specify: - Exact package versions. - Cryptographic hashes. - A lock file. - A trusted package index. - An isolated virtual environment. Python package installation executes package build and installation logic. Because unrestricted package names resolve to whatever versions the configured index currently serves, the effective dependency code can change after this Skill has been audited. The package names themselves do not appear to be typographical imitations, and the reviewed project does not automatically execute `pip`. The risk arises when users follow the runtime recommendation. ### Attack Path 1. A required package is absent. 2. The script tells the user to execute an unrestricted `pip install`. 3. The user runs the command in a privileged or sensitive Python environment. 4. A compromised package release, index, mirror, or transitive dependency is downloaded. 5. Package installation logic executes with the user's privileges. 6. Malicious dependency code can access files, environment variables, credentials, and network resources available to that account. ### Impact Assessment The resulting privileges equal those of the user runn ...[truncated 383 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mpstats_ozon_category_products.py:64

Finding

Unnecessary identifier transmission and excessive plaintext response retention

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (25)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mpstats_ozon_category_products.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The code builds destination URLs from environment-controlled base URLs and then sends sensitive data to them via requests.post. This includes phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens, so a modified environment can silently redirect credentials to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The gateway request path uses environment-derived base URLs and sends authenticated requests with the API key in the Authorization header via urlopen. If an attacker can influence the process environment, they can exfiltrate API keys and redirect billing/account operations to arbitrary infrastructure.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If the code behind this skill can send SMS codes, log users in, obtain API tokens, inspect account/team info, or initiate payments, that is a major scope expansion beyond Ozon category analysis. Such hidden account and payment capabilities are dangerous because they can trigger sensitive side effects and expose identity or billing data under the guise of a read-oriented analytics skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the code behind this skill can send SMS codes, log users in, obtain API tokens, inspect account/team info, or initiate payments, that is a major scope expansion beyond Ozon category analysis. Such hidden account and payment capabilities are dangerous because they can trigger sensitive side effects and expose identity or billing data under the guise of a read-oriented analytics skill.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

}

text

## Display Rules

1. **Compact category table** — key columns: `productId`, `title`, `brand`, `sellerName`, `price`, `monthlySalesUnits`, `monthlySalesRevenue`, `rating`, `balance`, `position`, `revenueSharePercent`.
2. **Revenue share = within this category query** — 0-100%; clarify the basis when presenting.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file's behavior is materially different from the declared skill purpose: instead of Ozon category analytics, it implements account onboarding, SMS login, API-key retrieval, and purchasing flows. This scope mismatch is dangerous because it can trick users into providing credentials and authorizing account actions unrelated to the advertised functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code contains order creation, payment method selection, and QR-code rendering for purchases even though the skill claims to provide marketplace analytics. Embedding billing capability in an unrelated skill increases the chance of deceptive monetization, unauthorized purchases, or user coercion into paying for services they did not intend to access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill performs SMS-based account login, token exchange, team discovery, and API-key generation despite being advertised as a product analytics integration. In this context, collecting authentication material and returning an API key is especially dangerous because users may disclose sensitive credentials under false pretenses.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill appears to require network access, environment-variable access, and filesystem writes, but it does not declare any explicit tool scope or permission boundary. That increases the blast radius if the skill is invoked unexpectedly or modified, because callers cannot easily see that it can read secrets and persist data locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown states that categoryPath must be the full Russian category path and that English translations will generally fail. This imposes a language-specific requirement on users without presenting it as an optional locale choice or clearly framing it as a justified region-specific constraint in the activation/usage policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation mandates writing full API responses to persistent local files even though the skill is presented as a query/analytics tool. Persisting full responses by default creates unnecessary data retention and raises the risk of later disclosure of user queries, marketplace data, session identifiers, or other sensitive metadata.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs persistent logging of full responses into session-organized project files, which can accumulate sensitive query results and contextual metadata over time. In a shared workspace or repository-backed environment, those files may be exposed to other agents, users, or version control, extending impact well beyond the immediate task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic feedback reporting to an external API is an extra outbound data-sharing capability unrelated to core category analytics. If triggered silently, it can transmit user intent, dissatisfaction, or task context without clear consent, creating privacy and policy risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 128)May include surrounding context.

| 402 | 算力或余额不足 | HTTP 402：按 SKILL.md 的 ## 解决认证和算力问题 处理。 | | 其他 | 业务异常 | 查看 errmsg；常见为 categoryPath 非俄语、非全路径、日期越过昨日等 |

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/mpstats/ozon/categoryProducts \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The onboarding flow instructs the operator to collect and submit a user's phone number and verification code to a local script, but provides no privacy notice, consent guidance, retention limits, or handling restrictions for that personal data. This creates a real privacy/security weakness because agents may solicit sensitive identifiers and OTP-related data without clear safeguards, increasing the risk of misuse, overcollection, or insecure logging.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script persistently stores full API responses, cache contents, and session metadata on disk, even though the skill is described as a query/return analytics tool. API responses may contain commercially sensitive marketplace data, identifiers, or usage/account metadata, and writing them under cwd/home/tmp increases retention and exposure to other local users, tools, or later tasks. The risk is amplified because storage happens by default, not as an explicit opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring promises that writing to /tmp is forbidden and that failure to write the current directory should error, but the implementation silently falls back to home and then the system temp directory. This discrepancy undermines operator expectations and can cause sensitive response data and session metadata to be written to less trusted locations, especially shared temporary storage. Security-relevant behavior that contradicts documentation is dangerous because users may make trust decisions based on the stated guarantees.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enforces an 11-digit phone format and hard-codes areaCode "+86", which restricts operation to a specific locale. There is no visible user choice or opt-in for locale/region handling, so the natural-language behavior forces a specific regional assumption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code generates or retrieves an API token and emits it directly in command output without any in-file warning about secret handling. This raises the risk of accidental exposure through logs, shell history capture, transcripts, or downstream tooling that stores stdout.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file documents reading LINKFOX_AGENT_API_KEY or LINKFOXAGENT_API_KEY from environment variables and sending the value in an Authorization header. Under the markdown-file warning criterion, credential use and transmission should be disclosed as a privacy/security-relevant behavior, but the document presents it only as an implementation detail with no explicit caution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a read-oriented analytics skill for drilling into Ozon category products and returning metrics such as sales, price, ranking, and inventory. Lines L148-L168 document an additional POST feedback capability to a different service, which is not part of the stated category-analysis function and is not justified by the skill purpose given in the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The module docstring and command help are presented entirely in Chinese, and the file does not offer an alternative language or user opt-in for locale. This can violate language policy when a skill forces a specific language by default rather than letting the user choose.

Content

No source excerpt is available for this finding.