多模态属性提取

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 1.0.7

Overview

This image-analysis skill includes sensitive account, billing, feedback-reporting, credential-handling, and local-persistence behavior that users should review carefully before installing.

Install only if you are comfortable sending product data and prompts to LinkFox, using LinkFox account credentials with this skill, and potentially creating payment orders through its onboarding helper. Avoid using it with confidential catalog data unless you accept the local response caching and external feedback behavior, and do not store API keys in shell startup files on shared or logged systems.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:119

Finding

Silent Transmission of Conversation-Derived Feedback to a Separate Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/multimodal_extract_attributes.py:37

Finding

Environment-Controlled Endpoints Can Receive API Keys, Login Tokens, and User Data

Content

View full analysis

str: """网关基础地址：env LINKFOX_TOOL_GATEWAY 优先，缺省回退正式地址。""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH ``` The API key, session metadata, and complete user parameters are then sent to that destination: ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding similarly permits all credential-bearing services to be replaced through environment variables: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` A ...[truncated 2512 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:478

Finding

Generated API Keys Are Printed to Standard Output and Recommended for Plaintext Shell Storage

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboarding documentation recommends commands that embed the key directly: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis Standard output is frequently captured by Agent transcripts, terminal logs, CI systems, shell redirection, monitoring systems, and parent processes. Returning the full API key as JSON therefore increases the number of places where the credential can persist. The recommended shell commands may also place the secret in shell history, process-launch records, terminal scrollback, and plaintext startup files. The startup-file permissions are not checked or hardened by the Skill. ### Attack Path 1. The user runs `onboarding.py login`. 2. The script obtains or generates an API key. 3. `_emit()` prints the complete key to standard output. 4. The terminal, Agent framework, CI service, or lo ...[truncated 674 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/multimodal_extract_attributes.py:250

Finding

Unsanitized Session Identifier Enables Output-Path Traversal

Content

View full analysis

str: """优先 env SESSION_ID；缺省按 HHMMSS-<6 hex> 生成（同一进程内稳定）。""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """返回 (linkfox_root, session_dir)；session_dir 一定存在。""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) ``` The onboarding script uses the same pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name even though it comes from the process environment. Values containing `..`, path separators, or an absolute path can cause `os.path.join()` to resolve outside the intended date/session directory. Subsequent operations write response files, metadata, indexes, and payment QR images beneath the resulting path. The scripts do not resolve the final path and verify that it remains under the expected LinkFox root. The attacker must be able to influence the execution environment. This ...[truncated 1120 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/multimodal_extract_attributes.py:102

Finding

Complete Analysis Responses and Caches Are Persisted Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:164

Finding

Runtime Guidance Recommends Installing Unpinned Third-Party Dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` The HTTP dependency is handled similarly: ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The suggested commands do not pin reviewed versions, require hashes, identify a trusted package index, or use a lockfile. A future compromised release, dependency-chain compromise, or unexpected incompatible update could therefore be installed and imported into the Skill's execution environment. The script does not automatically execute `pip`; exploitation requires the user or Agent to follow the displayed instruction. The package names are established packages rather than apparent typosquats, which limits severity, but the installation process remains non-reproducible. ### Attack Path 1. The environment lacks `qrcode`, `pillow`, or `requests`. 2. The user invokes functionality that requires the missing package. 3. The script recommends an unpinned `pip install` command. 4. The user or Agent runs that command. 5. The package index resolves the latest available release and its transitive dependencies. 6. A compromised or unexpectedly changed package executes installation or import-time code with the user's privileges. ### Impact Assessment A compromised dependency could execute arbitrary Python code with the privileges of the user running the installation or Skill. It could access env ...[truncated 208 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The request sent via urlopen includes multiple environment-derived values in headers, and the destination host is also overridable via LINKFOX_TOOL_GATEWAY. That means a caller or compromised environment can redirect requests to an attacker-controlled endpoint and exfiltrate the API key plus session/message identifiers, which is a real secret-leak and data-egress risk.

Content

Scanner excerpt · scripts/multimodal_extract_attributes.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Description-Behavior Mismatch

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is advertised as a multimodal product-image attribute extractor, but the file implements account onboarding, SMS verification, API-key retrieval, package browsing, order creation, and payment QR generation. This severe capability mismatch is dangerous because it can socially engineer users or operators into executing credential and billing workflows unrelated to the declared purpose, increasing the chance of unauthorized account access, secret collection, and unwanted charges.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, bearer tokens, and generated API tokens, to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect traffic to attacker-controlled servers and exfiltrate credentials or user data; in this skill, that risk is amplified because the code handles account login and key issuance rather than ordinary image-analysis traffic.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The gateway client composes URLs from environment-derived base addresses and transmits the API key in the Authorization header via urlopen. An attacker who controls the environment can redirect these requests to a malicious endpoint and capture the API key, user/account metadata, or order-related data, making this a practical credential-exfiltration vector.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is image attribute extraction, but the behavior reportedly includes account login, API key generation, account/team data access, package listing, payment order creation, QR code generation, and payment-status checks. This is a major description-behavior mismatch that can mislead operators and users into approving a skill that performs authentication, billing, and account-management actions outside its stated scope.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

- **columns**: Column definitions for rendering the result table.
- **costToken**: Total tokens consumed by the multimodal AI model.

## Display Rules

1. **Present data in tables**: Show extracted attributes in clear, well-formatted tables with product identifiers (ASIN, title) alongside the extracted attribute values.
2. **Highlight distribution**: When attribute groups are returned, summarize the distribution (e.g., "60% of products are red, 25% blue, 15% green") to give the user a quick overview.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding document adds account recovery, phone-based registration, and billing/payment flows that are outside the declared scope of an image-attribute extraction skill. This expands the skill's effective privileges into credential handling and payment orchestration, increasing the chance of data collection abuse, social engineering, and unauthorized account actions if the agent follows the documentation automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Documenting a flow to send SMS codes, log in users by phone, and retrieve API keys is not justified by the skill's stated purpose and introduces direct credential and identity-handling behavior. In the context of a product-image analysis skill, this is especially risky because users would not reasonably expect the skill to request phone numbers, verification codes, or perform account registration on their behalf.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The billing section enables plan listing, payment-method selection, order creation, and payment status checks, which are unrelated to image feature extraction. Embedding payment workflow logic inside an image-analysis skill creates an unjustified financial-action surface that could be abused to manipulate users into purchases or trigger unintended transactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Billing and payment-order creation are unrelated to extracting visual attributes from product images and materially expand the blast radius of the skill. In context, this enables a supposedly image-focused skill to initiate purchases and render payment QR codes, which could be abused for unauthorized spending or deceptive monetization flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code performs SMS-based authentication and returns an API key to the caller, even though the declared skill function is visual attribute extraction. In this context, that is especially dangerous because it turns an innocuous-seeming image skill into a credential-acquisition mechanism capable of obtaining long-lived access for user accounts or team spaces.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill appears to use environment variables, network access, and file writes but does not declare any explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it harder for reviewers or runtime policy to prevent unintended access to local files, credentials, or external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation criteria are broad enough to trigger on many generic image-analysis requests, including cases where the user did not explicitly ask for this specific external skill. Overbroad triggering can cause unintended data transfer to the tool, unnecessary cost consumption, and execution in contexts where users expected a narrower or local-only response.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs always writing complete API responses into a session-linked file under the current project directory, potentially storing product data, image-derived attributes, identifiers, and other sensitive business information beyond the immediate interaction. Persistent local storage in the workspace increases the chance of later unintended access, inclusion in commits, cross-task leakage, or exposure to other tools and users on the same environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The API reference explicitly instructs sending userInput, refResultData, image URLs, and product metadata to an external service, but it provides no privacy notice, data minimization guidance, or warning that user-supplied content will leave the local agent context. In a multimodal product-analysis skill, this increases the risk of unintentionally transmitting sensitive business data, proprietary catalog data, or personal data embedded in prompts or images to third-party infrastructure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The curl example demonstrates sending product image analysis prompts and embedded product/image data to an external endpoint, confirming real external transmission behavior. In this skill context, that is expected functionality, but it remains security-relevant because the example normalizes exporting potentially sensitive catalog, image, and user-provided context without any accompanying trust-boundary warning or sanitization guidance.

Content

Scanner excerpt · references/api.md (reported line 92)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/multimodal/extractPromptsFromMainImage \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instructions tell users to persist API keys in shell startup files and immediately source them, but provide no warning about local credential exposure, shell history leakage, shared-account risks, or safer secret-management alternatives. While common in developer docs, presenting this casually inside an unrelated skill increases the chance that sensitive keys are copied into insecure environments or mishandled by the agent/user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script always writes the full API response to disk, regardless of size, without any runtime warning or consent flow. Because the response may contain extracted attributes, prompts, identifiers, errors, or other sensitive business data, unconditional persistence increases the chance of accidental exposure on shared systems or in project directories.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring explicitly claims the script will not write to /tmp and will error if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This mismatch is security-relevant because users and reviewers may rely on the documented storage behavior when handling sensitive API responses, leading to unintended persistence in less trusted locations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This image-analysis skill also implements caching and persistent local data/session tracking that are not necessary for the narrowly described function. That broader behavior increases data retention and local exposure of potentially sensitive responses, especially when users expect transient analysis only.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code writes full responses, metadata, index files, and session-organized artifacts across multiple local locations, which materially expands the skill’s capability beyond simple image attribute extraction. If the API output contains sensitive product, customer, or proprietary prompt data, this persistence creates avoidable local disclosure and forensic residue.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The login command emits the user's API key directly to stdout JSON, which is commonly captured by logs, orchestration layers, transcripts, or downstream tools. Because the key grants API access, exposing it in normal command output creates a straightforward secret-leak path, especially risky in agent/skill environments where outputs are frequently persisted.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Examples like "Analyze the product images" and "Look at the main photos" are broad enough to match many ordinary requests, while the document does not clearly distinguish when this skill should be chosen instead of other image-analysis skills. This increases the risk of accidental or overly aggressive routing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.