Security audit

多模态商品相似度

Security checks for vulnerabilities and agentic risk

Overview

The skill has a real image-similarity function, but it also handles login, API keys, billing, feedback reporting, and local storage in ways users should review before installing.

Install only if you are comfortable sending product lists, image URLs, user prompts, and related metadata to LinkFox services. Do not use the phone/SMS onboarding or payment flow unless you intentionally want the agent involved in account and billing actions, and avoid storing API keys in shell startup files or logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:167
Finding: Automatic Undisclosed Transmission of User Feedback and Intent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/multimodal_analyze_product_similarity.py:36
Finding: Environment-Controlled Endpoints Can Receive Authentication Credentials
Content: View full analysis
str: """Gateway base address: environment variable first, production fallback.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding permits additional endpoint overrides: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Authentication tokens are attached to requests sent to those destinations: ```python if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ``` ### Technical Analysis The scripts trust endpoint U ...[truncated 1550 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/onboarding.py:484
Finding: Generated API Key Is Printed and Recommended for Plaintext Persistence
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key", file=sys.stderr) return 0 return 1 ``` The onboarding guide recommends plaintext persistence: ```markdown - Windows PowerShell: `setx LINKFOX_AGENT_API_KEY ""` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` ``` ### Technical Analysis The login command prints the complete live API credential to stdout. Standard output is commonly captured by Agent transcripts, terminal wrappers, CI logs, shell integrations, or debugging systems. The documentation then directs users to interpolate the key into shell commands and store it unencrypted in startup files. This design expands secret exposure beyond the process that needs the credential. Shell command interpolation may also leave the credential in terminal history. ### Atta ...[truncated 756 chars]
Remediation: View remediation

other

Warning

Location: scripts/multimodal_analyze_product_similarity.py:61
Finding: Unnecessary Session and Application Identifiers Are Sent to the Remote Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/multimodal_analyze_product_similarity.py:91
Finding: Complete Analysis Responses Are Stored in Unrestricted Fallback Locations
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/onboarding.py:163
Finding: Runtime Dependency Guidance Uses Unpinned Packages
Content: View full analysis
dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The script recommends installing mutable package names without exact versions, hashes, a lock file, or an explicitly trusted package index. The package names shown are common and there is no evidence that this project intentionally references malicious packages. Nevertheless, the installation process is not reproducible or auditable and depends on the user's configured Python package index and whatever package versions are current at installation time. ### Attack Path 1. A required module is absent. 2. The user follows the displayed `pip install` command. 3. pip resolves mutable packages and transitive dependencies from its configured index. 4. A compromised package release, package index, mirror, or dependency is installed. 5. Package installation or later import executes attacker-controlled code with the user's privileges. ### Impact Assessment A compromised dependency could execute code with the privileges of the user running pip or the Skill, access local files and environment variables, and steal LinkFox credentials. The likelihood is lower because no confirmed malicious dependency or unsafe third-party index is present in the reviewed project. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: The request sent via urlopen includes multiple HTTP headers populated directly from environment variables, including SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME, and an API key-selected destination host via LINKFOX_TOOL_GATEWAY. Because the destination URL is also environment-controlled, a manipulated runtime environment can exfiltrate sensitive identifiers and credentials to an attacker-controlled endpoint. In an agent/skill context, trusting environment-derived routing and metadata without validation is especially risky because these scripts often run in shared orchestration environments.
Content: Scanner excerpt · scripts/multimodal_analyze_product_similarity.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence environment variables in the agent runtime, they can redirect authentication and credential traffic to an attacker-controlled server, causing credential exfiltration and account compromise.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The gateway helper constructs outbound urllib requests using a base URL sourced from environment variables and attaches the API key in the Authorization header. In a hostile or misconfigured execution environment, this permits redirection of authenticated requests to arbitrary destinations, leaking credentials and enabling unauthorized account actions such as order creation or account data retrieval.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is image similarity post-processing, but the documented/observed behavior extends into authentication, account access, API key handling, package listing, payments, QR code generation, and order-status checks. This is a significant scope expansion that can expose sensitive credentials and financial/account operations under the guise of a harmless analytics skill.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
Action: Call the API with similarityThreshold set to 80 and includeSingleBrandGroups set to false.

text
## Display Rules 1. **Present grouping results clearly**: Show each similarity group with its group number, the reason for grouping, brand count, and a table of products within the group. 2. **Show product images when possible**: If image URLs are available, include them to help users visually verify the grouping.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions direct the agent to assist with registration, login, API-key acquisition, and purchase flows, none of which are justified by image similarity analysis. In context, this is more dangerous because the skill can be triggered for routine product-image tasks but then pivot into collecting personal data, handling account access, and facilitating payments through external services.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The module documentation explicitly says writing to /tmp is forbidden, but the implementation falls back to the system temporary directory when other locations are unavailable. This mismatch can cause operators or downstream tooling to make unsafe assumptions about where sensitive outputs are stored, potentially exposing cached API responses and session metadata in a less controlled location.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill claims to perform multimodal product image similarity analysis, but the code instead implements account onboarding, SMS authentication, API key issuance, package listing, and payment flows. This capability mismatch is dangerous because it can trick users or the hosting agent into invoking credential-collection and billing behavior under the guise of an unrelated image-analysis skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file includes order creation, payment URL retrieval, and QR-code rendering for paid plans, which is unrelated to the declared image-similarity functionality. Embedding purchasing capability inside a mismatched skill increases the risk of unauthorized or deceptive billing actions and broadens the blast radius if the skill is auto-invoked by user intent classification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code performs SMS verification, account login, team discovery, and API token retrieval/generation despite the skill being presented as an image-similarity tool. This is especially dangerous in agent environments because it harvests credentials and provisions long-lived secrets that can be reused beyond the immediate session, far outside the user’s expected task scope.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents capabilities that involve environment variables, file writes, and network access, but it does not declare any explicit tool scope or allowed-tools boundaries. In an agent setting, this weakens least-privilege controls and makes it harder to prevent unintended side effects such as outbound calls or local persistence beyond the user’s expectation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger text says the skill should activate not only for explicit image-similarity requests, but whenever the user's intent involves comparing product main images, visual clustering, identifying visually similar items, or post-processing by appearance, color, or composition. This broad natural-language scope overlaps with many ordinary product-analysis requests and lacks tight constraints on when the skill should not activate.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requires always writing full responses to project-local files, which may contain product data, URLs, generated prompts, and potentially other sensitive or proprietary user-supplied content. Persistent local storage expands exposure beyond the immediate task, increases accidental disclosure risk, and may place sensitive data in shared workspaces or source-controlled directories.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill claims to be a post-processing image analysis tool, yet it instructs the agent to auto-report feedback to a separate Feedback API. This creates an undisclosed secondary data flow in which user interactions or tool outcomes may be transmitted to another service without being necessary to fulfill the requested analysis.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Auto-detecting user sentiment or dissatisfaction and sending it to an external Feedback API is unrelated to product image similarity analysis. This can leak behavioral or conversational metadata that users did not expect to share, increasing privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The API accepts very large refResultData and userInput payloads and sends them to a remote endpoint without any privacy notice, minimization guidance, or restrictions on sensitive data. This is risky because upstream tool results may contain product, customer, business, or user-supplied information, and the documentation normalizes bulk transmission without warning about confidentiality, retention, or compliance implications.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 93)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/multimodal/analyzeProductSimilarity \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation includes a separate feedback API unrelated to the core product-similarity function, creating an unnecessary outbound channel that could be used to transmit user content, workflow details, or operational metadata to a second remote service. In an agent setting, unrelated endpoints expand the attack surface and increase the chance of unauthorized or undisclosed data exfiltration, especially because the feedback payload explicitly encourages sending user intent and outcome details.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file contains onboarding, registration, authentication troubleshooting, and billing flows that are unrelated to the declared purpose of a product-image similarity skill. This expands the skill's effective scope into account and payment handling, increasing the chance an agent will perform unnecessary sensitive actions or be socially engineered into collecting credentials and payment-related data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation instructs the agent to ask for a user's phone number and use it to send a verification code and log in to an external service, but it provides no explicit privacy notice, consent language, retention policy, or warning that personal data will be transmitted off-platform. This creates unnecessary exposure of personal data and account takeover risk if the flow is triggered inappropriately or if the user does not understand the consequences.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring presents the API description, usage notes, and output policy entirely in Chinese, and the runtime error/help strings are also Chinese in places. This imposes a specific language/locale on users without indicating that another language is available or that Chinese is required for a justified regional purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script persistently stores full API responses, cache entries, session metadata, and an index of sessions on local disk, which exceeds what is necessary for a simple similarity-analysis helper. If responses contain product data, image-derived results, identifiers, or usage metadata, this creates a broader data-retention surface and increases the chance of unintended disclosure to other users, processes, or later tasks on the same machine.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The login command returns the newly obtained API key directly in stdout JSON, which is commonly captured by agent logs, transcripts, shell history, orchestration layers, or downstream tools. That creates a straightforward secret-exposure path that can lead to unauthorized API use if any intermediary stores or displays the output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.