MPSTATS-Ozon商品趋势

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:25 AM UTC
• Version: 1.0.7

Overview

The skill's Ozon trend lookup is mostly coherent, but it also includes sensitive account, payment, credential, persistence, and automatic feedback behaviors that need user review before installation.

Install only if you are comfortable giving this skill a LinkFox API key and, when troubleshooting access, potentially using phone/SMS login and payment flows. Prefer self-service key setup, avoid pasting keys into chat or shell profile files on shared machines, verify no LINKFOX_* endpoint variables are set to untrusted hosts, and be aware that full API responses, cache files, and possible QR images may be written locally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:132

Finding

Automatic External Feedback Reporting Without Explicit User Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mpstats_ozon_product_trend.py:36

Finding

Environment-Controlled Endpoints Can Receive API Keys and Login Credentials

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` The onboarding client similarly permits all authentication-service destinations to be changed through environment variables: ```python def _env_base(name: str, default: str, *fallbacks: str) -> str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Sensitive authentication headers are then attached to requests: ```python if access_token: h["auth ...[truncated 2676 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mpstats_ozon_product_trend.py:252

Finding

Unvalidated Session Identifier Enables Output Path Traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) ``` The onboarding script has the same issue: ```python sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) ``` ### Technical Analysis `SESSION_ID` is treated as trusted despite originating from the environment. It is neither constrained to a safe identifier format nor checked after path resolution. Values containing `..` path components can escape the intended date and `linkfox` directories. On applicable platforms, an absolute path can also cause `os.path.join` to discard preceding components. Subsequent code creates directories and writes response JSON, metadata, index data, or QR image files under the resulting path. The final data filename is generated by the application, so this is primarily arbitrary-directory selection and file creation rather than unrestricted arbitrary-filename overwrite. Nevertheless, predictable metadata names such as `_meta.json ...[truncated 1197 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mpstats_ozon_product_trend.py:60

Finding

Agent Session and Application Metadata Is Sent With Every Trend Query

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:478

Finding

Generated API Key Is Printed to Standard Output and Recommended for Plaintext Persistence

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} Successfully obtained API key", file=sys.stderr, ) return 0 return 1 ``` The onboarding guide recommends inserting the complete key into persistent shell configuration: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis Printing the complete API key to stdout places it in the Agent's captured command output and potentially in conversation context, execution logs, CI logs, terminal scrollback, or redirected files. Persisting the key in shell startup files creates an additional plaintext copy that may be readable by local software, backup tools, shell-management utilities, support bundles, or other users if permissions are weak. The shown commands may also be retained in shell history when entered interactively. The onboarding process legitimately needs to provision a credential, but exposing the complete secret through genera ...[truncated 1157 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Runtime Installation Instructions Use Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mpstats_ozon_product_trend.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements LinkFox account onboarding, SMS login, API key acquisition, plan listing, order creation, payment QR generation, and order querying, which is unrelated to the declared Ozon product-trend analytics skill. This kind of scope mismatch is dangerous because it can be used to harvest user credentials, provision tokens, or monetize through payment flows under the guise of a benign analytics capability. The skill context makes this substantially more dangerous because users would not reasonably expect account-creation and payment behavior from an Ozon trend lookup tool.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The code constructs outbound request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables, they can redirect authentication and token flows to attacker-controlled infrastructure, resulting in credential exfiltration and account compromise. The mismatch between the skill's stated Ozon trend purpose and this onboarding/login behavior makes the risk more suspicious and less justifiable.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The gateway request path uses a URL derived from environment variables and includes the Authorization header populated from the agent API key. An attacker who can set the environment can redirect requests to a malicious server and capture the API key or induce unintended privileged actions against attacker-chosen endpoints. Because this skill is supposed to retrieve Ozon product trend data, embedding a generic authenticated gateway client and billing operations increases the danger and reduces any legitimate need for configurable secret-bearing destinations.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a severe description-behavior mismatch: a product-trend skill is reportedly tied to SMS login, API-key generation, account access, subscription browsing, payment order creation, and QR/payment rendering. Such hidden authentication and billing flows can collect sensitive user data, manipulate account state, or trigger financial actions under the guise of analytics, making the skill materially more dangerous than its stated purpose.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

2. **Aggregate vs time-series**: `mpstats-ozon-product-detail` gives a one-number-per-metric period view; this skill shows the day-by-day shape behind those numbers.
3. **Drill-down → trend**: After `brand-products` / `category-products` / `seller-products` surfaces a hot SKU, use this skill to validate whether the hotness is recent, seasonal, or sustained.

## Display Rules

1. **Prefer a simple table or sparkline-friendly output** — one row per date with `date`, `price`, `sales`, `balance`, `rating`, `comments`; do not overfit a 90-point series into a single paragraph.
2. **Use `hasData` to distinguish gaps from zero sales** — `hasData=false` means the day has no observation; don't report it as a zero-sale day.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code includes plan purchasing, order creation, payment URL retrieval, QR rendering, and payment-status querying despite the skill being described as an analytics tool. These billing capabilities can charge users or steer them into financial transactions unrelated to the promised function, creating a strong deception and abuse risk. In this context, the presence of payment logic is especially suspicious because it is not needed to answer Ozon trend questions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code sends SMS verification codes, logs users in with phone-based authentication, calls token-login endpoints, fetches team metadata, and generates API tokens, none of which are necessary for Ozon product trend retrieval. This creates a direct path to collect sensitive authentication factors and issue long-lived credentials under a misleading skill identity. The deceptive context materially increases risk because users may disclose phone numbers and SMS codes believing they are needed for analytics.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises capabilities that imply access to environment variables, file writing, and network operations, but it declares no explicit tool scope or permission boundaries. In an agent environment this weakens least-privilege controls and can let a seemingly simple analytics skill access secrets, exfiltrate data, or write files unexpectedly if the backing implementation is broader than described.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are intentionally broad and direct activation even when the specific tool is not named, increasing the chance the skill is invoked for loosely related requests. In the presence of hidden authentication, account, or billing behavior, overbroad triggering increases accidental exposure and makes misuse more likely.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs automatic feedback reporting based on user statements and model judgment, which can transmit user-provided content or interaction metadata to an external feedback API without explicit, informed consent. This creates a meaningful privacy risk because complaints, praise, intents, and free-form text may be forwarded outside the immediate task flow unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 72)May include surrounding context.

| 402 | 算力或余额不足 | HTTP 402：按 SKILL.md 的 ## 解决认证和算力问题 处理。 | | 其他非 200 值 | 业务异常 | 查看 errmsg / msg；常见为 productId 无效、日期越过昨日等 |

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/mpstats/ozon/productTrend \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation includes a separate public feedback-submission API that is outside the stated purpose of retrieving Ozon product trend data. In an agent setting, unrelated write-capable endpoints expand the action surface and can cause unintended external data transmission or user-content submission, especially if an agent interprets all documented APIs as available workflow steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The onboarding instructions tell the operator to collect and process a user's phone number and SMS verification code through a script, but provide no privacy notice, consent guidance, retention limits, or handling restrictions. This creates a real risk of unnecessary collection of sensitive personal data and credential-like authentication factors, especially because the skill encourages an alternate registration flow rather than directing the user to self-service by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown instructs permanently writing API keys into shell profile files and sourcing them immediately, without warning about credential persistence, shell history exposure, shared-account risks, or safer alternatives. While common operationally, embedding secrets into long-lived profile files can leak credentials to backups, dotfile sync, local users, or support tooling and increases the blast radius of compromise.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill persistently stores full API responses and cache files on local disk, including marketplace trend data and possibly request-correlated metadata, even though the tool is described as a read-only query skill. Unconditional persistence increases the risk of unintended data retention, cross-task data exposure, and later disclosure from shared workspaces or compromised local environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring states that writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and temporary directory. This mismatch can defeat operator expectations and policy controls, causing data to be written to less trusted locations where other users or processes may access it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The request includes SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME headers pulled from the environment and sends them to a remote gateway without explicit disclosure at the call site. While likely intended for tracing and product functionality, this still transmits contextual metadata off-host and may expose workflow identifiers or app context beyond what a user expects from a simple product-trend query.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script always writes the complete API response to disk before deciding whether to print inline or summarize, and it does so without an explicit runtime warning or user confirmation. This creates silent local persistence of potentially sensitive business or session-linked data, which is especially risky in multi-user or shared project directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code accesses LINKFOX_AGENT_API_KEY and LINKFOXAGENT_API_KEY, which are credential-bearing environment variables. The top docstring defers environment variable documentation to an external SKILL.md, so this file itself does not provide a direct warning or explanation about handling sensitive credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes returning daily Ozon product metrics, not creating local filesystem artifacts. Here the code creates writable directories and persists QR PNG files specifically to support checkout/payment, a capability outside the stated analytics context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The code writes payment QR-code PNG files into local session directories without clear in-file disclosure or lifecycle controls. On shared systems, these files may be discoverable by other users or tools, exposing payment links or transaction metadata and leaving unnecessary sensitive artifacts on disk. In this skill's context, persistent payment artifacts are also unexpected and therefore more risky.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The display rule instructs the agent to use the specific Chinese phrase "搜索位次数据在该赛道暂不可用" when search-visibility data is absent. This is a language-specific output requirement with no user opt-in or stated locale justification, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.