MPSTATS-Ozon商品详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.6

Overview

This skill mainly performs the advertised Ozon product-detail lookup, but it also includes sensitive account, token, billing, payment, feedback, and under-disclosed persistence behavior that users should review before installing.

Review this carefully before installing. Use it only if you are comfortable with LinkFox/MPSTATS API calls, local saving and caching of full product responses, and the bundled account and billing helper. Prefer self-service API-key setup when possible, confirm before any payment order is created, and avoid setting custom LINKFOX_* base URL variables unless you fully trust the destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes headers populated from environment variables, including the API key and optional routing/base URL from LINKFOX_TOOL_GATEWAY. Because the gateway host is environment-controlled and not allowlisted, a malicious or compromised environment can redirect the authenticated request and exfiltrate credentials and request data to an attacker-controlled endpoint. In a skill context, this is more dangerous because agents often run with privileged environment variables and unattended network access.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target is derived from environment-controlled base URLs and then used to send sensitive login workflow data, including phone numbers, SMS codes, access tokens, and refresh tokens. In a skill execution environment, environment variables are part of the trust boundary; if an attacker can influence them, this becomes a credential exfiltration channel and potential SSRF path.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request uses a URL built from environment-controlled base configuration and attaches the API key in the Authorization header before calling urlopen. If the base URL is redirected to attacker infrastructure, the skill will disclose the API key and perform unintended outbound requests, which is especially risky in an onboarding/payment utility.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes environment-variable access, file writes, and network operations but does not declare those capabilities or constrain their use. Undeclared capabilities reduce transparency and can hide sensitive behaviors such as credential handling, exfiltration, or persistence to the local workspace.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a product-detail lookup tool, but its documented fallback/onboarding behavior implies account operations, SMS login flows, API-key generation, billing/package lookup, payment order creation, and payment status queries. That mismatch is dangerous because a user or orchestrator may authorize a harmless-seeming data query while the skill performs identity, billing, or payment-related actions outside the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file documents a separate Feedback API that is unrelated to the declared purpose of this skill, which is Ozon product-detail lookup. In an agent setting, extra documented capabilities can expand the operational scope unexpectedly and may cause the agent to send user-derived content to a second endpoint, creating an unnecessary data egress path and increasing the risk of misuse or prompt-induced side effects.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script always persists full API responses to disk and also caches responses locally, which expands the data exposure surface beyond a simple transient batch lookup. Product-detail responses can contain commercially sensitive data, and local persistence increases the chance of unintended disclosure to other users, processes, backups, or later tasks on the same machine. In this skill context, batch queries make accumulated data retention more significant.

Intent-Code Divergence

High

• Confidence: 93% confidence
• Finding: The docstring states writing to /tmp is forbidden, but the implementation explicitly falls back to the system temporary directory when other locations are unavailable. This mismatch is dangerous because operators may rely on the documented guarantee and unknowingly allow sensitive full responses to be written into weaker, more broadly accessible temporary storage. In shared agent/runtime environments, temp directories materially increase exposure risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS login, API key issuance, plan browsing, ordering, and payment QR generation, which is materially unrelated to the declared skill purpose of Ozon product-detail lookup. Capability mismatch increases risk because users and reviewers may authorize a data-query skill that actually handles credentials, billing, and account state.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Payment and subscription purchasing logic is outside the reasonable scope of a SKU-detail lookup skill and can trigger billing-side effects, including order creation and QR-code payment prompts. In this context, those capabilities are more dangerous because they are hidden behind a benign marketplace-data description, making user surprise and misuse more likely.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script performs SMS-based login, token exchange, team lookup, and API-token generation, which goes well beyond a read-only product detail tool. Even if used for setup convenience, this broadens the attack surface to credential handling and secret issuance inside a skill that users may expect to be a simple data retriever.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger instructions are overly broad and direct activation even when the user does not explicitly mention MPSTATS or the tool, increasing the chance of unintended invocation. In a paid, networked skill that can consume credits and write files, over-triggering can cause unauthorized external requests, unnecessary spend, and disclosure of user data to third-party services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The onboarding flow explicitly instructs collecting a user's phone number and sending it to a registration script, but it does not include any privacy notice, consent language, retention limits, or explanation of how the phone number will be handled. In an agent context, this increases the risk of unnecessary collection of personal data and non-compliant handling of sensitive user information.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The output-path logic silently falls back to home or temporary directories while full API responses are always written to disk. Users are not clearly warned that data may be persisted outside the expected workspace, which can cause sensitive response data to end up in less controlled locations and remain there longer than intended. In agent environments, such silent fallback behavior increases the likelihood of cross-task or cross-user exposure.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.