Linkfox OS

• Outcome: Review
• Latest audit: Aug 3, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

This appears to be a real LinkFox e-commerce automation skill, but it handles SMS login, API keys, file uploads, payment orders, local logs, and public share links with insufficient scoping and warnings.

Review carefully before installing. Prefer creating your LinkFox account and API key in the official web UI instead of giving an agent an SMS code. Only use this in trusted workspaces, verify all LINKFOX_* base URL environment variables point to expected LinkFox domains, avoid uploading confidential files unless you intend to send them to LinkFox/S3-backed services, and treat generated share links and local .linkfox-os outputs as potentially sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tainted flow: 'url' from os.environ.get (line 241, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if with_uid:
        headers["uid"] = uid or _LOGIN_FIXED_UID
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=30)
        return r.json()
    except Exception as e:
        return {"_error": str(e), "_body": getattr(e, 'response', None) and e.response.text[:500] if hasattr(e, 'response') else ""}

• Confidence: 96% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=30)

Tainted flow: 'url' from os.environ.get (line 241, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if group_id:
        headers["tid"] = group_id
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=30)
        return r.json()
    except Exception as e:
        return {"_error": str(e), "_body": getattr(e, 'response', None) and e.response.text[:500] if hasattr(e, 'response') else ""}

• Confidence: 97% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=30)

Tainted flow: 'req' from os.environ.get (line 248, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                raw = resp.read().decode()
            return json.loads(raw)
        except urllib.error.HTTPError as e:

• Confidence: 98% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Tainted flow: 'req' from os.environ.get (line 248, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

time.sleep(1 << (attempt - 1))
        req = Request(url, method="GET", headers={"Authorization": api_key})
        try:
            with urlopen(req, timeout=30) as resp:
                raw = resp.read().decode()
            return json.loads(raw)
        except urllib.error.HTTPError as e:

• Confidence: 97% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares only an environment-variable requirement in metadata, but the instructions clearly direct file reads/writes and network calls, including uploading local files and storing outputs under local directories. This permission mismatch weakens reviewability and can mislead hosts or users about the skill's effective access, increasing the chance of unintended data exposure or execution in a more privileged context than expected.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script does more than authenticate and retrieve an API key: for new users it automatically invokes /account/loginByToken specifically to trigger promotional credits, using a fixed device fingerprint and no explicit user confirmation. In the context of an agent skill that auto-enters onboarding when billing/auth failures occur, this creates an abuse-prone flow that can mass-register accounts, harvest signup rewards, and perform account actions beyond the user's immediate request.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The onboarding trigger includes very broad phrases like 'recharge', 'registration', and phone-based signup, and the skill instructs scripted login/key acquisition flows. In a security-sensitive environment, broad natural-language triggers tied to credential/account provisioning can lead to unwanted account actions, collection of phone numbers and verification codes, or social-engineering-like behavior without sufficiently explicit consent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The onboarding trigger includes very broad phrases like 'recharge', 'registration', and phone-based signup, and the skill instructs scripted login/key acquisition flows. In a security-sensitive environment, broad natural-language triggers tied to credential/account provisioning can lead to unwanted account actions, collection of phone numbers and verification codes, or social-engineering-like behavior without sufficiently explicit consent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The onboarding trigger includes very broad phrases like 'recharge', 'registration', and phone-based signup, and the skill instructs scripted login/key acquisition flows. In a security-sensitive environment, broad natural-language triggers tied to credential/account provisioning can lead to unwanted account actions, collection of phone numbers and verification codes, or social-engineering-like behavior without sufficiently explicit consent.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The API reference describes generation of a public, no-login share URL for complete task process/results, but it does not prominently warn that using this feature can expose sensitive user inputs, outputs, files, or business data to anyone with the link. In the context of this skill, which handles cross-platform seller analytics, sourcing, documents, and uploaded media, accidental sharing could leak commercially sensitive or personal data even if access control on link creation is correct.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This documentation instructs the agent to perform SMS verification, login/registration, bonus-triggering login, team info retrieval, and API token generation as a scripted flow, but it does not require explicit per-step user confirmation or prominent warnings that these are account-affecting actions. In an agent skill, this is dangerous because the agent could drive account creation, session establishment, and credential issuance on the user's behalf, causing unauthorized account changes or token minting if triggered by ambiguous user input or prompt injection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The flow describes fetching account status, selecting packages, creating orders, and generating payment QR codes without mandating an explicit purchase-confirmation checkpoint immediately before order creation. In this skill's context, that is especially risky because the onboarding logic auto-triggers on billing-related errors and user phrases like '充值', making unintended or socially engineered purchase initiation more plausible.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The onboarding flow explicitly instructs the agent to collect a user's phone number and SMS verification code and relay them through external scripts/services, but it does not require a clear privacy notice, consent step, or disclosure that personal data will be shared with third-party systems. This creates a real privacy/security weakness because users may unknowingly provide sensitive authentication material to an automated agent, increasing the risk of account takeover, mishandling of personal data, or noncompliant data processing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file recommends appending API keys directly into shell startup files such as ~/.zshrc and ~/.bashrc without warning that this stores secrets in plaintext on disk. Plaintext persistence raises exposure risk from local compromise, backups, shared accounts, shell history mistakes, or accidental disclosure when dotfiles are synced or inspected.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This catalog instructs use of multiple external IP/compliance services that accept user-supplied images, titles, descriptions, and patent identifiers, but it provides no warning that this data will be transmitted to third-party providers. In the context of an agent that may process seller assets, product drafts, and potentially non-public materials, that omission can cause unintentional disclosure of sensitive business data or personal information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file documents multiple tools that can create, update, delete, schedule, upload, and persist data to external systems, but it does not require explicit user confirmation, warn about side effects, or distinguish read-only from mutating operations. In an agentic environment, this omission increases the risk that an LLM will autonomously trigger destructive or privacy-impacting actions against product data, spreadsheets, reports, or scheduled tasks without informed user consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script logs JWT-derived identifiers (`uid` and `name`) to stderr, which can expose account-linked personal data in terminal history, CI logs, agent traces, or centralized logging systems. Even though the JWT is only decoded locally and not printed in full, emitting user identifiers without necessity or disclosure creates a privacy leak and increases risk of correlation across systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script fetches account profile data and prints `nickName` plus team-account status to stderr, disclosing user profile information during a billing/onboarding flow. In this skill context, onboarding is triggered automatically on auth or balance failures, so these logs may be generated frequently and captured by orchestration layers, making unintended exposure more likely.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script prints the API key in JSON to stdout, which is commonly captured in agent logs, transcripts, shell history, orchestration pipelines, or chat-visible tool output. Because this skill is designed to automate onboarding when users lack credentials, exposing freshly generated secrets in tool output materially increases the chance of credential leakage and downstream account compromise.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill requires verbatim forwarding of progress labels and file lines, including `[文件]` resource URLs and potentially user-derived paths or query contents, with no filtering. Because these values originate from upstream tools and task prompts, they can contain sensitive user data, internal paths, or attacker-injected content, creating a direct disclosure channel to the user or chat transcript.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The mandatory instruction to forward all returned data-file links wholesale creates a strong exfiltration path for any artifacts produced by the remote pipeline. In this skill's context, those artifacts may include uploaded user materials, scraped datasets, reports, or other sensitive outputs, and the rule removes any opportunity for least-privilege disclosure or relevance filtering.

Ssd 3

High

• Confidence: 98% confidence
• Finding: This flow tells the agent to solicit a user's phone number and then handle SMS-based registration to obtain the user's API key on the user's behalf. Asking the agent to collect both identity data and a one-time authentication factor is dangerous because it effectively turns the agent into an intermediary for account enrollment and credential issuance, which can enable phishing-like behavior, account compromise, and improper access to user accounts.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The registration sequence explicitly instructs the agent to receive the SMS code from the user and exchange it for an API key via login scripts. This is a strong true positive because SMS codes are authentication secrets, and training the agent to collect and use them normalizes credential interception and creates a direct path to impersonation or unauthorized account access if mishandled.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The script intentionally persists original prompts and task identifiers to local files in the current workspace. In this skill context, prompts may contain product plans, credentials pasted by mistake, business data, or other sensitive seller information, so normal file inspection, backup systems, or shared workspaces can expose that data beyond the original session.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Streaming the agent's intermediate thoughts, tool calls, file paths, and messages to stderr can leak sensitive business data, uploaded file references, or internal workflow details into terminal logs and observability systems. In agent environments, stderr is often captured automatically, so this broadens exposure of transient data that users may not expect to be retained.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.obfuscated_code

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/linkfox_os.py:1269

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/upload/upload_common.py:87

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: scripts/onboarding/_qrgen.py:607