Linkfox OS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.2

Overview

This is a real e-commerce integration, but it handles login codes, API keys, uploads, and public task links with safeguards that users should review before installing.

Install only if you trust LinkFox and are comfortable sending prompts, local uploaded files, phone/SMS login data, payment choices, and API keys through this workflow. Use official LinkFox endpoints only, avoid custom URL environment overrides, avoid submitting confidential material, and prefer a secure secret store over shell rc files for the API key. Treat generated share links as public links that may expose the task process and results for up to one year.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/linkfox_os.py:803
• Finding: Automatic Download of Unvalidated Server-Supplied URLs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/linkfox_os.py:803-820` **Vulnerability Type**: Unvalidated remote resource retrieval **Risk Level**: Medium ### Vulnerable Code ```python def _download_resource_link(uri: str, name: str, output_dir: str) -> str: """将 resource_link 的 HTTPS URL 下载到 output_dir，返回本地路径。 若 uri 是 file:// 协议则跳过（无法远程下载）。失败时打印警告并返回空字符串。 """ if not uri or uri.startswith("file://"): return "" try: # 用 name 作为文件名兜底，从 URL 末尾取原始文件名 url_filename = uri.rstrip("/").split("/")[-1].split("?")[0] filename = url_filename or (name.replace(" ", "_") + ".bin") local_path = os.path.join(output_dir, filename) urlretrieve(uri, local_path) return local_path except Exception as e: print(f"Warning: 下载文件失败 [{name}] {uri}: {e}", file=sys.stderr) return "" ``` Server-provided URLs are passed to this function automatically from task event data: ```python uri = item.get("uri") or item.get("url") or "" name = item.get("name") or item.get("title") or "data" if uri and not uri.startswith("file://") and uri not in _seen_rl_uris: _seen_rl_uris.add(uri) task_dir = ensure_task_dir(msg_id) local = _download_resource_link(uri, name, task_dir) ``` ### Technical Analysis The implementation treats remote task results as trusted download instructions. It rejects only `file://` URLs and does not: - Require HTTPS. - Restrict downloads to approved LinkFox or S3 domains. - Reject loopback, private, link-local, or reserved destination addresses. - Validate the destination after redirects. - Limit the downloaded response size. - Validate the expected content type. - Stream the response with a strict byte limit. `urlretrieve()` follows the supplied URL and writes the complete response to disk. If an attacker can influence the LinkFox task result, compromise a configured API endpoint, or inject a malicious `resource_link`, the client can be induced to acces ...[truncated 1486 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Accept only `https://` resource URLs. 2. Maintain an explicit allowlist of approved LinkFox and storage origins. 3. Resolve the destination hostname before connecting and reject loopback, private, link-local, multicast, and reserved IP ranges. 4. Repeat hostname and IP validation after every redirect, or disable redirects entirely. 5. Stream downloads in bounded chunks and enforce a documented maximum file size. 6. Enforce connection and read timeouts. 7. Validate content type and file extension against the expected resource type. 8. Generate local filenames independently instead of trusting URL-derived names. 9. Avoid overwriting existing files by using exclusive creation or randomized filenames. 10. Require user confirmation before downloading from an origin outside the normal LinkFox storage domains. ]]>

other

Warning

• Location: scripts/linkfox_os.py:1030
• Finding: Public Task Share Links Are Created Automatically Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/linkfox_os.py:1030-1047` **Vulnerability Type**: Unintended public data exposure **Risk Level**: Medium ### Vulnerable Code ```python # 任务已终态：尝试拉工作台公开分享链接（后端会二次校验归属+终态），有则显示 share_url = "" share_id = "" if stop_reason and message_id: share_resp = fetch_share_url(message_id) if isinstance(share_resp, dict) and "error" not in share_resp: share_url = share_resp.get("shareUrl") or "" share_id = share_resp.get("shareId") or "" if share_url: lines.append("") lines.append("--- 分享链接 ---") lines.append(f"ShareUrl: {share_url}") if share_id: lines.append(f"ShareId: {share_id}") elif isinstance(share_resp, dict) and share_resp.get("error"): lines.append("") lines.append(f"(获取分享链接失败: {share_resp.get('error')})") ``` The share-link request is implemented as: ```python def fetch_share_url(message_id: str) -> dict: """任务终态后调用 /agent-studio/task/getShareUrl 换取工作台公开分享链接。 仅在 stopReason 非空后调用；后端会二次校验（任务归属 + 终态），失败时返回 带 error 字段的 dict，调用方按需展示或忽略。 """ if not message_id: return {"error": "missing messageId"} return api_request(SHARE_URL_ENDPOINT, {"messageId": message_id}) ``` The Skill documentation states that the generated link is public, does not require authentication, and remains valid for one year. ### Technical Analysis Public sharing is not required to submit, execute, poll, or retrieve a task. Nevertheless, every terminal task causes an automatic request to create or retrieve a public share URL. There is no command-line opt-in, consent prompt, confidentiality check, or warning before the public link is generated. Task records may contain: - Confidential prompts and business questions. - Tool execution traces. - Generated market or product reports. - References to user-uploaded files. - Remote event messages and resource links. The generated public URL is printed to output and pe ...[truncated 965 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable public sharing by default. 2. Add an explicit `--share` option or obtain informed user confirmation before requesting a share URL. 3. Warn the user that the link is public and may expose prompts, outputs, and tool traces. 4. Allow users to choose a short expiration period. 5. Provide a revocation mechanism and document how to revoke existing links. 6. Avoid writing share URLs to local metadata unless the user explicitly requested persistence. 7. Apply a confidentiality check before sharing tasks involving uploaded files, personal data, credentials, or proprietary business information. 8. Prefer authenticated, access-controlled sharing where supported. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:145
• Finding: Remote Service Content Is Required to Be Relayed Verbatim as Trusted Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:145-188` **Vulnerability Type**: Remote-output instruction hijacking **Risk Level**: Medium ### Vulnerable Instruction ```text How to relay to user (VERBATIM, do NOT rephrase): - status=running — for each NEW steps[].label (not already shown), output the label VERBATIM as a line. Do NOT rephrase, summarize, or interpret. Copy the label string exactly. ``` The instructions further require unconditional forwarding of resource lines: ```text CRITICAL: [文件] lines are resource/data file URLs produced by tool calls. You MUST output them verbatim to the user — they are the actual data file links the user needs. Do NOT skip, summarize, or omit [文件] lines. ``` ### Technical Analysis The event labels originate from the remote LinkFox service and are therefore outside the local Skill's trust boundary. Requiring the host Agent to reproduce those labels exactly prevents normal safety filtering, contextualization, and validation. A compromised or attacker-influenced remote service could return content that: - Impersonates trusted Agent instructions. - Claims that unsafe actions are mandatory. - Includes misleading or malicious links. - Attempts to alter the current task or the user's security expectations. - Requests disclosure of credentials or local information. - Advertises unrelated services. Because the content is rendered as the Agent's own response rather than clearly quoted as untrusted service output, users may incorrectly attribute it to the local Agent. ### Attack Path 1. An attacker influences a task's remote event stream or compromises a configured LinkFox-compatible endpoint. 2. The endpoint returns a crafted `steps[].label` or resource line containing deceptive instructions or malicious links. 3. `SKILL.md` directs the host Agent to reproduce the content verbatim and forbids interpretation. 4. The malicious text appears in the conversation as trusted Agent output. 5. The user follow ...[truncated 643 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every remote event label and URL as untrusted data. 2. Clearly delimit remote service output, for example by placing it under a heading such as “LinkFox service progress.” 3. Remove instructions that require unconditional verbatim forwarding. 4. Permit the host Agent to suppress, summarize, or warn about unsafe and irrelevant content. 5. Validate resource URLs before displaying or retrieving them. 6. Reject remote content that requests credentials, local file access, policy changes, or unrelated actions. 7. Preserve factual progress information while stripping imperative or deceptive language. 8. Ensure remote content can never override system, developer, user, or safety instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/linkfox_os.py:55
• Finding: Authentication Secrets Can Be Redirected to Unrestricted Environment-Controlled Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `scripts/linkfox_os.py:55-134` **Vulnerability Type**: Credential disclosure through unvalidated endpoint configuration **Risk Level**: Medium ### Vulnerable Code ```python # 从环境变量取 BASE_URL，默认生产环境 LINKFOXAGENT_BASE_URL = os.environ.get( "LINKFOXAGENT_BASE_URL", "https://agent-api.linkfox.com/" ) ``` ```python def api_request(endpoint: str, payload: dict) -> dict: """Make a POST request to the linkfox-os API.""" api_key = get_api_key() # rstrip/lstrip 兼容环境变量值带或不带末尾斜杠 url = f"{LINKFOXAGENT_BASE_URL.rstrip('/')}/{endpoint.lstrip('/')}" data = json.dumps(payload).encode("utf-8") req = Request( url, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "linkfox-os-skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=30) as response: result = json.loads(response.read().decode("utf-8")) ``` The same pattern applies to authentication and onboarding destinations: ```python def _get_login_base() -> str: return ( os.environ.get("LINKFOX_LOGIN_API_URL") or "https://api.linkfox.com" ).rstrip("/") def _get_agent_user_base() -> str: return ( os.environ.get("LINKFOX_AGENT_USER_API_URL") or "https://agent-api.linkfox.com" ).rstrip("/") ``` Credential-bearing requests then send access tokens to those destinations: ```python headers = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": "https://ai.linkfox.com", "Referer": "https://ai.linkfox.com/", "source": "agent-linkfox-web", "authorization": access_token, "uid": build_uid_header(access_token, user_id), } ``` ### Technical Analysis The Skill permits several service origins to be replaced through environment variables without validating: - The ...[truncated 1859 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use fixed official origins by default for all credential-bearing production requests. 2. Require HTTPS for every configured endpoint. 3. Enforce an exact hostname or origin allowlist. 4. Permit custom endpoints only when an explicit development flag is enabled. 5. Display the selected nonstandard destination and require confirmation before transmitting secrets. 6. Never send production credentials to test or custom endpoints. 7. Use separate environment variables and credentials for development environments. 8. Reject URLs containing user information, fragments, unexpected ports, or non-HTTP schemes. 9. Document the trust implications of every endpoint override. 10. Consider certificate or public-key pinning for especially sensitive login and token-generation operations. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/onboarding.md:94
• Finding: Onboarding Instructions Persist Bearer API Keys in Plaintext Startup Configuration<![CDATA[ ## Vulnerability Details **File Location**: `references/onboarding.md:94-116` **Vulnerability Type**: Plaintext credential persistence **Risk Level**: Low ### Vulnerable Instructions ```powershell setx LINKFOXAGENT_API_KEY "your-key" ``` ```bash echo 'export LINKFOXAGENT_API_KEY="your-key"' >> ~/.zshrc # or echo 'export LINKFOXAGENT_API_KEY="your-key"' >> ~/.bashrc source ~/.zshrc # or source ~/.bashrc ``` The surrounding guidance tells the Agent to help the user apply this configuration after obtaining the generated API key. ### Technical Analysis The API key is a bearer credential. Persisting it directly in `.zshrc`, `.bashrc`, or the Windows user environment leaves it available indefinitely in plaintext. Shell startup files and user environment settings may be: - Readable by other software running under the same account. - Included in backups or diagnostic archives. - Synchronized between devices. - Accidentally copied into support requests. - Disclosed through terminal or command history. - Loaded into every child process launched from the shell. The instructions do not verify file permissions, avoid command history, establish expiration, or describe key rotation and revocation. Repeated appends may also leave obsolete credentials in the same file. This persistence is user-authorized configuration rather than a system backdoor, but it creates avoidable secret-management risk. ### Attack Path 1. The onboarding script generates or retrieves an API key. 2. The user or Agent follows the documented startup-file command. 3. The bearer token remains in plaintext in a shell configuration file or persistent user environment. 4. Local software, a backup, a diagnostic collection, or an accidental disclosure obtains the token. 5. The attacker uses the token to authenticate to LinkFox APIs. ### Impact Assessment Exposure grants the privileges assigned to the API key, potentially including task submission, task retrieval, access to account-relat ...[truncated 152 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer the operating system's credential manager or the host Agent's dedicated secret store. 2. If file-based storage is unavoidable, use a dedicated secrets file with owner-only permissions such as `0600`. 3. Load the secret only for commands that require it rather than exporting it to every child process. 4. Avoid placing the literal token in shell command history. 5. Check and correct file permissions before saving the key. 6. Replace existing entries instead of repeatedly appending credentials. 7. Document token rotation and revocation procedures. 8. Warn users not to commit shell configuration or secret files to source control. 9. Mask tokens in all normal logs and terminal output. 10. Offer a session-only environment configuration as the safer default. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (62)

Tainted flow: 'req' from os.environ.get (line 122, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

)

    try:
        with urlopen(req, timeout=30) as response:
            result = json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 97% confidence
• Finding: The request destination is derived from LINKFOXAGENT_BASE_URL, an environment variable, and the code sends the Authorization API key to whatever host that variable names. In an agent/skill context, environment variables are part of the execution trust boundary, so a malicious workspace or launcher can redirect traffic to an attacker-controlled endpoint and exfiltrate credentials and submitted prompts.

Tainted flow: 'url' from os.environ.get (line 241, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if with_uid:
        headers["uid"] = uid or _LOGIN_FIXED_UID
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=30)
        return r.json()
    except Exception as e:
        return {"_error": str(e), "_body": getattr(e, 'response', None) and e.response.text[:500] if hasattr(e, 'response') else ""}

• Confidence: 95% confidence
• Finding: The request target is derived from environment variables and the function sends login material plus a fixed/custom uid header to that destination. If an attacker can influence LINKFOX_LOGIN_API_URL, they can redirect authentication traffic to an arbitrary server and capture verification/login data, making this an SSRF-plus-credential-exfiltration issue rather than a benign configurable endpoint.

Tainted flow: 'url' from os.environ.get (line 241, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if group_id:
        headers["tid"] = group_id
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=30)
        return r.json()
    except Exception as e:
        return {"_error": str(e), "_body": getattr(e, 'response', None) and e.response.text[:500] if hasattr(e, 'response') else ""}

• Confidence: 97% confidence
• Finding: This function posts Authorization, uid, and optional team identifiers to a base URL taken from environment variables. If LINKFOX_AGENT_USER_API_URL is attacker-controlled, the code will exfiltrate bearer tokens and identity headers to an arbitrary host, directly exposing account or team API access.

Tainted flow: 'req' from os.environ.get (line 248, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                raw = resp.read().decode()
            return json.loads(raw)
        except urllib.error.HTTPError as e:

• Confidence: 96% confidence
• Finding: gateway_post builds the destination from environment-controlled base URL data and always includes the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY can redirect these authenticated POST requests to infrastructure they control, causing secret exfiltration and potentially enabling arbitrary use of the stolen API key.

Tainted flow: 'req' from os.environ.get (line 248, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

time.sleep(1 << (attempt - 1))
        req = Request(url, method="GET", headers={"Authorization": api_key})
        try:
            with urlopen(req, timeout=30) as resp:
                raw = resp.read().decode()
            return json.loads(raw)
        except urllib.error.HTTPError as e:

• Confidence: 95% confidence
• Finding: The GET helper sends the Authorization header to a URL assembled from environment input without verifying the destination. This permits redirection of authenticated requests to attacker-controlled servers, exposing the API key and allowing unauthorized reuse of that credential.

Tainted flow: 'req' from os.environ.get (line 56, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", "Authorization": api_key},
        )
        try:
            with urlopen(req, timeout=30) as resp:
                raw = resp.read().decode()
            return json.loads(raw)
        except urllib.error.HTTPError as e:

• Confidence: 90% confidence
• Finding: The code builds the POST target from LINKFOXAGENT_BASE_URL, which is read from the environment, and sends the Authorization API key to that URL. If an attacker can influence the environment or runtime configuration, they can redirect requests to an attacker-controlled server and capture the API key and request payloads.

Tainted flow: 'req' from os.environ.get (line 56, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

"""执行签好名的 PUT。失败抛 RuntimeError 带上响应体前 300 字。"""
    req = Request(url, method="PUT", data=body, headers=headers)
    try:
        with urlopen(req, timeout=60) as resp:
            if resp.status // 100 != 2:
                raise RuntimeError(f"S3 PUT 非 2xx: {resp.status}")
    except urllib.error.HTTPError as e:

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

---

## 0. Output Rules (MANDATORY)

**禁止输出任何 emoji / 表情符号 / 图形字符**（包括但不限于笑脸、勾叉、纸夹、文件夹、灯泡、警告标志、旗帜、动物等 Unicode emoji）。

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The workflow explicitly instructs the agent to collect a user's phone number and one-time SMS code, then use them to authenticate and retrieve account credentials on the user's behalf. This is highly sensitive because SMS codes are authentication factors, and routing them through an agent normalizes credential interception patterns and can enable account takeover if mishandled or abused.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill directs the agent to obtain the user's API key from the login flow and then help place that secret into environment-variable commands, which risks exposing the key in conversational transcripts, tool logs, terminal history, and persistent config files. Because the agent is both retrieving and rendering the credential, the workflow centralizes secret handling in an unsafe channel.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

�量：`LINKFOX_AGENT_API_URL` 或回退 `LINKFOX_TOOL_GATEWAY`）。

**Windows（PowerShell，永久写入用户环境变量）**：
```powershell
setx LINKFOXAGENT_API_KEY "你的key"
```
配置后重启 PowerShell 或 Claude Code 会话生效。

**macOS / Linux（zsh / bash，写入 shell rc）**：
```bash
echo 'export LINKFOXAGENT_API_KEY="你的key"' >> ~/.zshrc   # macOS 默认 zsh
# 或
echo 'export LINKFOXAGENT_API_KEY="你的key"' >> ~/.bashrc  # Linux 默认 bash
source ~/.zshrc   # 或 source ~/.bashrc
```

注意：`>>` 是追加，仅首次配置执行一次；重复执行会在 rc 文件里产生重复行（不影响功能但污染文件，可用文本编辑器删除多余行）。

如使用 fish shell，请自行配置等价的环境变量。

## 入口 2：计费不足充值

1. **列套餐**：调 `python <skill>/scripts/onboarding/list_plans.py`，输出 JSON 套餐清单（含 `plan_id`、`name`、`price`、`currency`、`credits`、`description`、`available_meth

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key() -> str:
    """Get API key from environment. Reads LINKFOXAGENT_API_KEY only."""
    key = os.environ.get("LINKFOXAGENT_API_KEY")
    if not key:
        print(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description says to use the skill for 'any multi-step e-commerce workflow,' which is an open-ended catch-all rather than a narrowly bounded trigger. Although examples are provided, this phrasing leaves unclear where the skill should not activate and risks overmatching many routine commerce-related requests.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: These lines impose mandatory output rules in Chinese-tagged format and categorically forbid alternate presentation styles, regardless of user preference. This is a natural-language policy concern because the skill forces a fixed locale/style convention instead of offering user choice or documenting a justified locale-specific constraint.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill requires verbatim forwarding of all progress step labels and especially all `[文件]` lines, including resource URLs and local file paths, without filtering. If upstream tasks handle sensitive user uploads, private artifacts, or internal paths, this creates a built-in disclosure channel that can expose data unnecessarily to the user or to unintended viewers of the chat transcript.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: At L250 the document states 'There is no ShareURL in the linkfox-os API.' However, L272-L278 says the script automatically calls `/agent-studio/task/getShareUrl` and appends a public share link section that must be forwarded to the user. This is an active contradiction in the skill's own intent/documentation, not merely an omission.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The result rules mandate outputting all data-file entries and any generated public share link to the user. Because the share URL is described as a public link valid for a long duration and data files are exposed via public download URLs, this can unintentionally disclose task artifacts, uploaded materials, and derived reports beyond the minimum necessary scope.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly states that `getShareUrl` returns a public URL that can be sent to others and viewed without login, but it does not prominently warn about privacy, data exposure, or the sensitivity of the full task history and results being disclosed. Even with ownership and terminal-state checks, an authorized user can still unintentionally expose confidential prompts, outputs, tool traces, or linked resources by sharing the URL.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The example prompt explicitly specifies '美国站英语' for listing generation, and the file otherwise presents agent behavior as normative reference material. This can violate language/locale policy when the skill is framed to require a specific language rather than offering a user-selectable locale or documenting the constraint as optional.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The '带货口播' section states default values of language=英语 and salesRegion=美国. A fixed default locale in policy-facing documentation can create a language/locale policy violation unless the skill clearly offers user choice or explains the constraint as region-specific behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented flow enables SMS-based account login/registration, retrieval of team identifiers, and generation of long-lived API tokens that become `LINKFOXAGENT_API_KEY`. This is a sensitive account-management and credential-provisioning capability; if exposed through a broadly callable skill without strict authorization, consent, and secret-handling controls, it could let the skill obtain or mint credentials for user accounts and then use them for downstream paid operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown instructs handling of phone numbers, SMS verification codes, access tokens, refresh tokens, and generated API keys, but it does not include user-facing privacy, consent, retention, or redaction requirements. In an agent context, this omission is dangerous because operators may collect secrets and personal data in prompts, logs, or transcripts, increasing the risk of credential leakage, account takeover, and privacy violations.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The onboarding instructions, prompts, and example user-facing text are entirely in Chinese, and the flow directs the agent to use that wording without presenting an opt-in or alternative language. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly justified.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow instructs the agent to solicit a user's phone number and then an SMS verification code, but it does not require a clear warning that these are sensitive authentication factors. In this context, the agent is effectively acting as an intermediary in an account login flow, which increases phishing and account-takeover risk if users are not explicitly informed about what is being collected and why.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill tells the agent to append an API key to shell startup files, which persists the secret on disk and may expose it to other local users, backups, shell history mishandling, or accidental sharing of dotfiles. Although persistence may be operationally convenient, the instructions omit a clear warning about the security tradeoff of long-lived plaintext secret storage.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.obfuscated_code

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/linkfox_os.py:1269

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/upload/upload_common.py:87

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: scripts/onboarding/_qrgen.py:607