产品标题分析

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 1.0.6

Overview

The skill performs title analysis, but it also bundles account login, SMS verification, API-key generation, billing, and payment-order flows that require careful review before installation.

Install only if you trust LinkFox with product-title data, account onboarding details, API keys, and payment setup. Prefer obtaining and configuring API keys yourself, review any phone/SMS or payment prompt carefully, avoid setting endpoint override environment variables unless you control the destination, and keep the generated linkfox data directory out of shared repos or backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, and this request can carry sensitive material such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In a skill runtime, allowing untrusted environment configuration to redirect these requests can exfiltrate credentials to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request URL is also built from environment-controlled base URLs and is invoked with the Authorization header loaded from environment API keys. If an attacker can influence environment variables, they can redirect authenticated requests and capture the API key or cause the skill to act against unintended endpoints.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes sensitive environment-derived headers such as LINKFOX_AGENT_API_KEY, SESSION_ID, MODE_ID, and APP_NAME, while the destination base URL is overridable by the LINKFOX_TOOL_GATEWAY environment variable. If an attacker can influence that environment variable, the script will exfiltrate credentials and session metadata to an arbitrary host over the network.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares itself as a title-analysis helper, but its instructions require use of environment variables, network access, and persistent file writes without any explicit permission boundary. Hidden capability expansion is dangerous because it enables access to secrets and exfiltration or storage of conversation-derived data outside the immediate user-visible workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a severe scope mismatch: a skill presented as product-title analysis also contains instructions for SMS verification, account login, API-key generation, package lookup, order creation, payment QR generation, and payment-status polling. Such unrelated account and payment operations materially increase the attack surface and could lead to unauthorized transactions, credential handling, and privacy exposure under the guise of a benign analytics task.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documentation embeds a separate feedback-submission API that is unrelated to the stated title-analysis function, creating an opportunity for the skill to transmit conversation-derived data to an additional external endpoint beyond the user's expected processing path. Even if intended for quality feedback, this expands the data-exfiltration surface and can lead to unauthorized sharing of user content or behavioral data without clear user awareness or consent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file documents authentication recovery, API key acquisition, scripted registration, and billing/payment flows that are unrelated to a product-title analysis skill. This scope expansion is dangerous because it authorizes sensitive account and payment handling behaviors in a context where users would reasonably expect only text analysis, increasing the chance of credential collection, account misuse, or social-engineering abuse.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documentation instructs obtaining API keys, registering accounts via phone verification, listing plans, creating orders, and checking payment status, none of which are justified by the declared title-analysis purpose. In skill context, this is more dangerous because the unexpected sensitive capabilities can be used to harvest identifiers, manipulate user accounts, or drive unauthorized purchases under the guise of a harmless analytics tool.

Description-Behavior Mismatch

Critical

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS login, API key acquisition, package purchase, order querying, and payment QR generation, which is fundamentally unrelated to the declared product-title analysis skill. This mismatch is highly suspicious because it expands the skill into credential collection and billing flows that users and reviewers would not expect from the stated functionality.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing and payment creation are unjustified for a title tokenization skill and introduce the ability to initiate purchases and render payment instructions. In this context, the feature set is dangerous because it can steer users into spending money through functionality hidden inside an unrelated skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script performs SMS verification, login, token-based session establishment, user/team discovery, and API key retrieval/generation, none of which are needed for title analysis. In a mismatched skill, this is effectively credential harvesting and secret provisioning behavior concealed behind a benign description.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The API accepts product data and potentially prior conversation data via refResultData, but the documentation provides no user-facing warning that such information may be transmitted to an external service for LLM-backed analysis. This creates a privacy risk because users may unknowingly cause sensitive commercial data, product metadata, or prior chat context to be sent off-platform without informed consent or minimization.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs collecting a user's phone number and using it in scripted registration/login flows without any privacy notice, retention limits, consent language, or explanation of where the data is sent. That creates avoidable privacy and compliance risk, especially because phone numbers are personal data and the skill’s advertised purpose gives users no reason to expect identity onboarding behavior.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill instructs persistent storage of full tool responses in a session-linked project directory, which can retain product, account, and conversation-derived data beyond the immediate interaction. Persistent local logging increases the likelihood of sensitive data exposure to other tools, users, repositories, backups, or accidental commits, especially because the path is tied to the working directory.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This code transmits data externally via requests.post, including authentication and onboarding material. External transmission is especially risky here because the skill's declared purpose does not justify sending phone numbers, codes, or token-related data to remote services.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.