MPSTATS-Ozon卖家商品查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.7

Overview

The skill performs the advertised Ozon seller analytics, but it also adds sensitive account, billing, credential-storage, endpoint-override, and automatic feedback-reporting behaviors that need review before installation.

Review this skill carefully before installing. Use it only if you are comfortable with LinkFox account onboarding, API key handling, paid-credit purchase flows, local response retention, and outbound feedback reporting. Do not enter SMS codes or payment choices through the skill unless you trust the publisher and endpoint configuration, and avoid storing API keys in shell profile files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:165

Finding

Automatic External Disclosure of Conversation-Derived Feedback Without Explicit Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mpstats_ozon_seller_products.py:36

Finding

Environment-Controlled Endpoints Can Redirect Credential-Bearing Requests

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def get_api_key(): key = ( os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") ) if not key: sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script exposes additional destination overrides: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com", ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https ...[truncated 2628 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:484

Finding

Generated API Key Is Printed to Standard Output and Recommended for Plaintext Shell Persistence

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: return 0 return 1 ``` The onboarding instructions recommend placing the complete key in persistent shell configuration: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login command serializes the complete API key into standard output. In an agent environment, stdout may be retained in conversation transcripts, command logs, CI output, terminal scrollback, debugging captures, or observability systems. The documentation further recommends appending the credential to shell startup files. Those files are plaintext, commonly backed up or synchronized, and may be readable by other software running under the same user account. The commands can also remain in shell history with the secret embedded directly in the command line. Returning a generated secret is necessary at some layer of onboarding, but printing it through a general output chann ...[truncated 959 chars]

Remediation

View remediation

other

Warning

• Location: scripts/mpstats_ozon_seller_products.py:64

Finding

Product Requests Transmit Unnecessary Agent Session Metadata

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:31

Finding

Onboarding Relies on Unpinned Runtime Dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: return { "png_path": None, "ascii_qr": None, "error": "pip install qrcode pillow", } ``` The requests-dependent path similarly instructs installation through an unversioned `pip install requests` command when the package is absent. ### Technical Analysis The project does not include a locked dependency manifest, reviewed version constraints, or package hashes for `requests`, `qrcode`, and `Pillow`. Runtime guidance tells users to install packages by name from the resolver's configured package index. This leaves the installed versions dependent on the current index state and environment configuration. Dependency compromise, malicious mirrors, dependency confusion, or future incompatible releases could introduce code into credential and payment workflows. The affected script handles phone numbers, SMS verification codes, access and refresh tokens, API keys, team identifiers, payment URLs, and QR data, making dependency integrity particularly important. ### Attack Path 1. A required package is absent. 2. The onboarding script reports an installation command without a pinned version or hash. 3. The user executes the command using the environment's configured package index. 4. A compromised release, malicious mirror, or substituted package is installed. 5. The dependency executes when onboarding, login, or QR rendering is retried. 6. Malicious dependency code reads process data, tokens, API key ...[truncated 474 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mpstats_ozon_seller_products.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code lets environment variables control the base URLs for login and agent-user APIs, then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints via requests.post. If an attacker can influence the runtime environment, they can redirect authentication traffic to attacker-controlled servers and exfiltrate credentials and tokens; this is especially dangerous because the file’s purpose already includes token issuance and account onboarding.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header containing the LinkFox API key. An attacker who can set the environment can redirect these requests to an arbitrary host and capture the API key and related billing/account data, effectively turning the CLI into a credential exfiltration path.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is seller-product analytics, but the detected behavior includes SMS login, token handling, API key generation/retrieval, account/team inspection, subscription listing, payment order creation, QR rendering, and order-status checks. That is a severe hidden-capability mismatch: it could trick operators into authorizing account access, credential flows, or billing actions under the guise of a read-only analytics skill.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

}

text

## Display Rules

1. **Compact store table** — key columns: `productId`, `title`, `brand`, `price`, `monthlySalesUnits`, `monthlySalesRevenue`, `rating`, `balance`, `turnoverDays`, `lostProfit`, `position`.
2. **Revenue share = within this seller query** — 0-100%; clarify the base.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file embeds authentication recovery, account registration, and billing purchase workflows that are outside the stated purpose of an Ozon seller analytics skill. This unjustified expansion of capability can cause an agent to collect credentials, guide account creation, or initiate commercial actions unrelated to analytics, increasing the risk of abuse, social engineering, and unauthorized account/payment handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly authorizes collecting a phone number, sending SMS codes, logging in, listing plans, and creating payment orders, none of which are necessary to analyze Ozon seller products. In the context of this skill, these are high-risk operational capabilities that could be misused to register accounts, intercept sensitive authentication flows, or induce the user to make purchases.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation promises that writing to /tmp is forbidden and that failure to write the current directory will error, but the implementation silently falls back to home and temporary directories. This mismatch can defeat operator expectations and policy controls, causing data to be written to less trusted locations where other users or processes may access it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file is functionally unrelated to the stated Ozon seller-product analytics skill and instead implements LinkFox account onboarding, login, API key issuance, package purchase, and order/payment operations. That capability mismatch is dangerous because it expands the skill into credential handling and financial actions that users would not reasonably expect from a read-only analytics integration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code can list plans, create orders, and render payment QR codes, introducing billing and transaction functionality that is unjustified for an analytics skill. In context, this makes the skill more dangerous because it enables monetization and purchase flows under the guise of seller analytics, increasing the risk of unauthorized or deceptive financial operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file performs SMS-based login, refresh/access token handling, team discovery, and API token generation, all of which are far beyond what is needed for Ozon seller drill-down analytics. Because the skill context is read-oriented marketplace analysis, embedding identity and token-issuance flows materially raises the risk of account compromise, silent credential collection, and privilege expansion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope even though its instructions imply access to environment variables, filesystem writes, and network calls. Without a least-privilege allowlist, the runtime may permit broader capability use than users or reviewers expect, increasing the blast radius if the skill is abused or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger criteria are broad enough to activate on general Ozon seller-analysis intent even when the user did not explicitly request this specific skill. Over-broad activation can route unrelated requests into a high-cost or higher-privilege workflow, especially problematic here because the skill also appears to have hidden account/payment capabilities.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill mandates persistent logging of full API responses into session-scoped files under the working directory. Those retained artifacts may contain seller-query details, identifiers, account metadata, or other sensitive content, and storing them by default increases exposure through later workspace access, backups, or accidental commit/sync.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 128)May include surrounding context.

| 402 | 算力或余额不足 | HTTP 402：按 SKILL.md 的 ## 解决认证和算力问题 处理。 | | 其他 | 业务异常 | 查看 errmsg；常见为 sellerId 不是数字、该 ID 不存在、日期越过昨日等 |

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/mpstats/ozon/sellerProducts \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document embeds a second API for submitting feedback that is unrelated to the seller-products analytics function. In an agent-skill context, unrelated outbound endpoints expand the skill’s effective capability surface and can be abused to exfiltrate user content or operational metadata under the guise of feedback, especially because the instructions provide a ready-to-call public URL and payload format.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown instructs the agent to ask for a user's phone number and process SMS-based login without any clear privacy notice, retention limits, masking guidance, or prohibition on storing or retransmitting the data. This creates an unnecessary sensitive-data collection path and raises the risk of privacy violations, mishandling of personal data, and unsafe credential-recovery behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends user-supplied parameters together with SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME to a remote service without explicit disclosure at runtime. In this skill context, the network call is expected, but forwarding extra identifiers and analytics inputs without transparency can leak operational metadata and user context beyond what is necessary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persistently stores full API responses, cache contents, and session metadata on local disk even though the skill's stated purpose is to return seller analytics. If responses contain sensitive business data or identifying session information, this creates unnecessary data retention and enlarges the exposure surface to other local users, later processes, backups, or accidental disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring presented to users is entirely in Chinese and describes the CLI interface and behavior without any indication that other languages are supported. This is a natural-language policy concern because the skill imposes a specific language on all users rather than offering an opt-in or documented locale constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The display rule mandates a specific language/locale behavior: Russian titles must be preserved and only translated on request. This constrains language presentation by default rather than offering a user choice or making the locale preference explicit upfront.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents reading an API key from environment variables and sending it in the Authorization header, but it does not include any caution about protecting credentials or avoiding exposure in logs/shared terminals. Because SQP-2 applies to markdown files when descriptions omit warnings about privacy-sensitive behavior, this merits a low-severity disclosure finding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code accesses LINKFOX_AGENT_API_KEY or LINKFOXAGENT_API_KEY from the environment to authorize the request. While this is functionally necessary, the file lacks any user disclosure that the skill consumes credentials from the environment, which falls under sensitive environment-variable access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.