MPSTATS-Ozon商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.7

Overview

The skill performs Ozon product search, but it also handles account login, phone/SMS verification, API key setup, payment order creation, automatic feedback reporting, and persistent local storage, which is broader than a simple search skill.

Install only if you are comfortable with this skill using LinkFox/MPSTATS network services, reading and helping persist a LinkFox API key, collecting phone/SMS login details for account setup, creating unpaid payment orders for recharge flows, writing full results to local linkfox folders, and sending feedback to LinkFox. Prefer self-service API-key setup, avoid shared machines for shell-profile secrets, review LINKFOX_* URL environment variables, and do not run payment or phone-login commands unless explicitly intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target is derived from environment-controlled base URLs and then used to send login, SMS, and token-bearing requests with headers that may include authorization material. In a skill/runtime environment where env vars can be influenced by the host or another component, this enables SSRF-like redirection and credential exfiltration to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is also built from environment-sourced base configuration and used with urllib to transmit API-key-authenticated requests. If the base URL is overridden, the skill can be coerced into sending the user's API key and order/account traffic to an attacker-controlled server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises no explicit permissions, yet its instructions require access to environment variables, network calls, and persistent file writes. This mismatch weakens transparency and consent boundaries, making it easier for a caller to trigger data access or storage behaviors they did not reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is product search, but the referenced behavior includes account login, SMS verification, API key generation, account retrieval, and payment/order workflows. Bundling identity, credential, and billing operations into a search skill creates a dangerous scope gap that can lead to unauthorized account actions, unexpected charges, or credential exposure under the guise of a benign lookup tool.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file embeds account onboarding, authentication recovery, phone-based registration, and billing/payment workflows inside a skill whose stated purpose is Ozon product search. This significantly expands the skill's operational scope into credential handling and payments, creating opportunities for phishing, unauthorized account provisioning, and collection of sensitive user data unrelated to the business function.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documentation instructs the agent to drive plan listing, payment-method selection, order creation, and account login flows that are not justified by an Ozon search skill. In an agent setting, these actions can normalize collecting sensitive information and sending users into payment flows without strong verification that the destination, script, and purpose are legitimate.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script persistently stores full API responses, cache entries, and session metadata on disk under linkfox/, including product-search results and run metadata beyond the narrow search function described by the skill. This expands the data-retention surface and can expose potentially sensitive business queries, account-linked session identifiers, or API-returned data to other local users, later processes, or accidental inclusion in project artifacts.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring states that writing to /tmp is forbidden and that failure to write the current directory should error, but the implementation silently falls back to home-directory or temporary-directory storage. This mismatch undermines operator expectations and can lead to data being written into less controlled locations, increasing the chance of unintended disclosure or persistence.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, login, API-key retrieval, plan listing, and payment operations that are unrelated to the declared Ozon product-search skill. Such scope deviation is dangerous because it expands the data and permission surface far beyond user expectations, enabling unnecessary collection of phone numbers, tokens, and billing actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can create orders and render payment QR codes for WeChat/Alipay, which is unrelated to searching Ozon products. In this context, billing capability is especially risky because a user invoking a marketplace-search skill would not reasonably expect payment flows, making unauthorized or deceptive purchases more plausible.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The SMS login and API-key provisioning flow collects phone numbers, verification codes, access tokens, refresh tokens, group IDs, and generated API keys despite the skill being described as product search. This unnecessary identity and credential handling increases privacy risk and creates a high-value target for credential leakage or misuse.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger logic is overly broad and says the skill should activate for essentially any Ozon product-discovery intent, even when MPSTATS is not explicitly requested. Overbroad routing increases the chance of unintended tool invocation, unnecessary external data sharing, and surprise costs or side effects from the downstream service.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The feedback API example encourages sending free-form user-derived content to a separate external endpoint without any privacy notice, consent requirement, or minimization guidance. If an agent forwards user prompts, business data, or identifiers verbatim, this can leak sensitive information to a third party and create compliance and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide explicitly tells the operator to ask for a user's phone number and use it for script-based registration, but provides no privacy notice, retention limits, or verification safeguards. In practice this can lead to unnecessary collection of personal data and account creation on behalf of a user without adequate informed consent or identity validation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file instructs users to persist API keys into shell profiles and immediately source them, but omits warnings about credential exposure, shell history leakage, shared-machine risks, and unintended configuration side effects. This encourages unsafe secret-handling practices and can leave long-lived credentials broadly accessible on the host.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill requires persistent logging of full responses into session-scoped files in the current working directory. This can retain user-supplied queries, seller/product data, account-related error details, or other sensitive content beyond the immediate task, increasing exposure to other tools, users, commits, backups, or accidental disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 86% confidence
• Finding: This code performs external transmission of sensitive onboarding data, including phone numbers, SMS codes, tokens, and possibly generated API credentials. External transmission is expected for login flows, but in this mismatched skill context and with configurable endpoints, it materially increases the risk of privacy leakage and credential exposure.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.