多模态图像识别

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 1.0.6

Overview

This image-analysis skill is mostly coherent, but it includes public local-image uploads, account and payment workflows, automatic feedback reporting, and durable local logs that need careful review before installation.

Install only if you are comfortable sending image URLs and requirements to LinkFox, uploading local images to public-read storage when local paths are used, storing full recognition results locally, and using the bundled phone-login and payment helper for API access or credits. Avoid using it on confidential screenshots, documents, personal photos, regulated data, or private business images unless you have reviewed the data-sharing and retention implications.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent via urlopen includes multiple environment-derived headers, and the destination host is also overrideable through LINKFOX_TOOL_GATEWAY. That creates a tainted flow where session metadata and the API key can be exfiltrated to an attacker-controlled endpoint if the environment is influenced by a hostile caller or compromised runtime.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exercises environment-variable access, file writes, and network operations, yet no explicit permissions are declared. This weakens governance and user understanding of what the skill can do, especially because it can upload files, persist outputs, and access credentials without a clear permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is image recognition, but the referenced behavior includes account/login, package purchase, recharge order creation, payment QR generation, order polling, and local-file upload. This is a significant scope expansion that can lead operators or users to authorize actions involving billing, account state, and data disclosure they did not expect from an image-analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Automatic submission of feedback to a separate API is unrelated to the core image-recognition purpose and may transmit user sentiment, task details, or interaction context without clear consent. This creates unnecessary data egress and expands the skill's behavior beyond what users would reasonably expect.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill says local file paths are not applicable, but elsewhere instructs operators to upload local files to make them usable. This contradiction obscures the actual data flow and can cause users to expose local images publicly when they believed local files were unsupported.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as an image-recognition utility, but it persistently stores full API responses and session-organized artifacts to local disk by default. For multimodal/OCR workloads, responses may contain sensitive image-derived text or personal data, so default retention materially increases exposure beyond what users would expect from simple recognition.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code creates _meta.json and index.jsonl files that track session IDs, dates, file paths, and skill usage across sessions, which is unrelated to the core image-recognition function. This builds a local activity ledger that can expose user behavior and sensitive workflow metadata if the workspace is shared or later collected.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The docstring explicitly says writing to /tmp is forbidden, but the implementation falls back to the temporary directory when other paths are unavailable. This mismatch is dangerous because operators may rely on the documented guarantee while the code actually writes potentially sensitive responses to a less controlled location.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS verification, API-key retrieval, package listing, order creation, and payment QR generation, which is unrelated to the declared image-recognition skill. This mismatch is dangerous because it can trick users or the hosting platform into granting credentials, performing account actions, or initiating purchases under the guise of benign multimodal analysis.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: These routines fetch purchasable plans, create orders, and generate payment artifacts despite the skill being presented as an image-recognition tool. Embedding commerce and account-management actions in an unrelated skill increases the chance of unauthorized purchases and deceptive behavior, especially if invoked automatically by a user seeking only image analysis.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This section performs SMS-based authentication, token exchange, team/user discovery, and API token issuance, none of which are justified by the stated multimodal image-analysis purpose. In context, the code appears designed to harvest phone-based login credentials and mint reusable API keys, making the deceptive skill context substantially more dangerous.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill is presented as an image recognition/analysis capability, but this script uploads arbitrary local image files to remote object storage and returns a public URL. That broadens the skill from analysis into external data transfer, creating a significant risk of unintended local file exfiltration and public disclosure, especially in an agent context where users may not realize local files are being published.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The script retrieves API credentials from environment variables to perform remote storage operations that are not clearly justified by a simple image-recognition skill. In an agent environment, hidden credential-backed upload capability increases risk because it enables silent outbound transfers using privileged service access.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs uploading local images to obtain a public URL, but gives no explicit privacy or sensitivity warning. Local images often contain personal, confidential, or regulated content, and publishing them via a public URL can cause immediate unintended disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Feedback API section instructs callers to send free-form `content` containing user statements, intent, and outcome to an external service, but provides no privacy warning, minimization guidance, or consent requirement. In an agent skill context, this creates a real risk of unintentionally exfiltrating sensitive user data, prompts, URLs, or image-derived content to a separate third-party endpoint unrelated to the primary tool call.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The onboarding flow explicitly instructs collecting a user's phone number and using it to register/login via a script, but it provides no privacy notice, consent language, retention limits, or guidance on secure handling of that personal data. In a support/onboarding context this creates unnecessary privacy and compliance risk, especially because phone numbers and one-time codes are sensitive authentication-related data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends user-supplied image-recognition parameters and session identifiers to a remote API without any runtime notice, consent gate, or minimization. In this skill context, inputs may include image URLs, OCR targets, or sensitive content references, so silent transmission to a third-party service raises meaningful privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The upload request sets the object ACL to public-read and the script returns a public URL, but there is no explicit warning or consent mechanism informing the user that the local image will become publicly accessible. This can lead to accidental exposure of sensitive images, documents, screenshots, or metadata embedded in image files.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill requires persistent logging of full API responses into session-linked project files and sometimes stdout. Because responses may include OCR text, descriptions of sensitive images, URLs, and session metadata, this creates durable exposure of potentially confidential user content and increases the blast radius of any local compromise or accidental log sharing.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.