ClawHub
Back to skill

Security audit

MPSTATS-Ozon卖家商品查询

Security checks across malware telemetry and agentic risk

Overview

The skill provides the advertised Ozon analytics, but also bundles sensitive login, API-key, billing, feedback, and credential-handling flows that need Review before installation.

Install only if you trust LinkFox with Ozon analytics data, phone/SMS onboarding, API-key issuance, and billing workflows. Prefer completing login and payment directly on the official LinkFox site, avoid custom LINKFOX_* endpoint overrides unless you control them, and treat any API key printed by the scripts as a secret.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
93% confidence
Finding
The request sent via urlopen includes multiple environment-derived values in headers, and the destination base URL is also overrideable through LINKFOX_TOOL_GATEWAY. That creates a tainted path where secrets and contextual identifiers can be transmitted to an attacker-controlled endpoint if the environment is manipulated, causing credential and metadata exfiltration.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
93% confidence
Finding
The code sends authentication material and other sensitive data to URLs derived from environment-controlled base endpoints via requests.post. If those environment variables are altered, the CLI can be redirected to an attacker-controlled host, causing SMS login data, access tokens, refresh tokens, and generated API keys to be exfiltrated.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
92% confidence
Finding
The gateway request uses urlopen against a URL assembled from environment-controlled base configuration while attaching the API key in the Authorization header. An attacker who can influence environment variables can redirect these requests to a rogue server and capture the agent API key and account/order data.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions, yet its instructions clearly require reading environment variables, writing files to the local project directory, and making network calls. This hidden capability expansion breaks least-privilege expectations and can expose secrets, persist sensitive data locally, or trigger external actions without a transparent permission model.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill is presented as a seller-product analytics tool, but the detected behavior includes account login, SMS verification, API-key retrieval/generation, plan listing, payment order creation, QR rendering, and payment-status querying. That is a major privilege and purpose expansion: a user invoking analytics could be funneled into authentication, billing, and account-management flows they did not intend, increasing risk of data exposure, unauthorized purchases, and phishing-like abuse.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill mandates automatic feedback reporting whenever results mismatch intent, the user comments on the skill, or the analyzer believes something could be improved. This creates an unjustified outbound data flow unrelated to seller-product drill-down and may transmit user content, behavior, or dissatisfaction signals to an external service without explicit consent.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The documented storage restriction says outputs must stay under the current working directory and must not use /tmp, but the implementation falls back to the home directory and temporary directory. This discrepancy can cause sensitive API responses to be written to less controlled locations, undermining operator expectations and potentially exposing data through broader filesystem access or cleanup mechanisms.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements account onboarding, SMS login, API key issuance, package listing, order creation, and payment QR generation, which is materially unrelated to an Ozon seller analytics skill. That mismatch increases the risk that the skill is being used to collect credentials and drive purchases under the guise of marketplace analysis.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The code includes package purchase and payment workflow support, including order creation and QR code rendering, despite the skill being presented as an analytics capability. In this context, hidden commerce functionality is dangerous because it can trigger unexpected billing actions and expands the blast radius far beyond the user's expected task.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The file performs SMS-based authentication, access-token handling, user/team discovery, and API token generation even though the skill description is about analyzing Ozon seller products. In this context, credential acquisition is especially risky because users would not reasonably expect a seller analytics skill to log them in and mint reusable API credentials.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger rules instruct activation even when the user does not mention MPSTATS, as long as the intent loosely resembles seller analysis. Overly broad triggering increases the chance this skill runs in contexts where the user did not intend to invoke a paid, networked, file-writing tool, which can cause unnecessary data access, external requests, and charges.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The onboarding instructions tell the operator to collect a user's phone number, process SMS login, obtain an API key, and guide payment actions, but they do not require explicit consent, identity verification, or a warning about handling sensitive data and account-affecting operations. In an agent setting, this creates a real social-engineering and privacy risk because the workflow normalizes requesting secrets and initiating billing-related actions through the assistant.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
Phone numbers and SMS verification codes are transmitted to remote services, but the file does not provide clear in-flow disclosure that sensitive personal data is being sent off-box. In a skill that appears to be analytics-focused, that lack of transparent notice raises the chance of users sharing sensitive data without informed consent.

Missing User Warnings

High
Confidence
96% confidence
Finding
The login flow retrieves or generates API tokens and then returns the API key in stdout JSON. Emitting reusable credentials to standard output is dangerous because they may be captured by logs, calling frameworks, transcripts, shell history, or other downstream systems.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
83% confidence
Finding
This is a real external transmission of user-supplied and sensitive authentication data to remote services. Network transmission is expected for login, but in this skill's context it remains security-relevant because the functionality is unrelated to the declared analytics purpose and may expose credentials or PII to third parties.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.