Security audit

睿观-版权检测

Security checks for vulnerabilities and agentic risk

Overview

This copyright checker has a real stated purpose, but it also bundles public image upload, account login, API-key handling, payments, local storage, and automatic feedback reporting that users should review carefully.

Review before installing. Use this only if you are comfortable sending image URLs, and possibly local image files, to LinkFox services; local uploads are made public for about 24 hours. Avoid submitting confidential or unreleased images unless that exposure is acceptable. Treat phone-number login, OTP handling, API-key output, and payment QR flows as sensitive account and billing actions, and prefer first-party account pages where possible. Check and delete local linkfox output/cache files if the results contain sensitive business data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tainted flow: 'req' from os.environ.get (line 57, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: ) try: with urlopen(req, timeout=120) as response: if response.status not in (200, 201): print(f"Upload failed with status: {response.status}", file=sys.stderr) sys.exit(1)
Confidence: 87% confidence
Finding: The script uploads arbitrary local image content to whatever presigned URL is returned by the gateway, without validating the destination host or scheme. If the gateway endpoint is misconfigured, compromised, or redirected via environment-controlled base URL, local files could be exfiltrated to an attacker-controlled endpoint under the guise of a presigned upload.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill exposes capabilities to read environment variables, write files, and access the network, but does not declare permissions or obtain explicit user-aware authorization boundaries. This makes the skill harder to audit and increases the chance that sensitive actions such as API key use, persistence of user data, or outbound transmission occur unexpectedly.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as an image copyright checker, but its documented behavior extends into account login, SMS verification, billing, payment QR generation, order management, and file upload. This functional overreach violates least surprise and can trick users into disclosing phone numbers, initiating purchases, or sending files to third parties under the guise of a simple copyright check.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatically reporting feedback to a separate external API is unrelated to the core copyright-detection task and creates a covert data egress path. User comments, satisfaction signals, or task details may be transmitted to another service without necessity or informed consent.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file introduces authentication recovery, phone-based registration, API-key setup, and billing/payment workflows that are outside the stated purpose of an image copyright detection skill. This expands the skill's effective scope into account provisioning and commerce handling, increasing the chance of unauthorized data collection, abuse of user trust, and execution of privileged operational steps unrelated to the advertised function.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation explicitly instructs handling user phone numbers, verification codes, API-key retrieval, and payment ordering even though none of these capabilities are justified by the skill's declared copyright-detection purpose. In context, that mismatch is dangerous because a user invoking a content-analysis skill would not reasonably expect identity, credential, or purchase workflows, making phishing-style misuse and overcollection of sensitive data more plausible.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements account onboarding, SMS login, API key acquisition, package listing, order creation, and payment QR generation, which are unrelated to a copyright-detection skill. This scope mismatch is dangerous because it introduces credential-handling and monetization capabilities that can be triggered under the guise of an unrelated skill, expanding abuse potential and user surprise.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code can fetch or generate API tokens for a user group, a privileged capability not justified by image copyright-risk analysis. Exposing token-generation logic inside this skill increases the chance of credential issuance and misuse, especially because the returned key is later emitted to stdout JSON.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Creating paid orders and rendering payment QR codes is unrelated to copyright detection and introduces a direct financial transaction capability. In skill context, this is more dangerous because users invoking an analysis tool would not reasonably expect order placement or payment workflows, creating risk of unauthorized purchases or deceptive upsell paths.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill sends SMS verification codes and performs phone-based login, exceeding the declared purpose and collecting sensitive identifiers. In context, this broadens the trust boundary from content analysis into identity and account access, which is unnecessary and increases the blast radius if the skill is abused or misrouted.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The docstring promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation silently falls back to the home directory or temporary directory. For a copyright-detection skill that may process sensitive image-analysis results, this can cause data to be persisted in less trusted locations than users expect, undermining privacy and storage-boundary assumptions.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script intentionally makes the uploaded image publicly readable and returns a public URL, which expands exposure far beyond what is minimally required for analysis. In a copyright-detection context, users may upload proprietary, unreleased, or sensitive images; exposing them publicly creates confidentiality, privacy, and potential legal risks.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill instructs local image upload to obtain a public URL but does not clearly warn that the user's local file will be transmitted to an external service and exposed via a publicly accessible link. In a copyright-review context, uploaded images may contain proprietary, unpublished, or customer-sensitive content, making accidental disclosure particularly risky.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The automatic feedback-reporting instruction does not warn users that their interaction details may be sent to an external feedback endpoint. This creates a hidden disclosure channel for user statements and task context that is unrelated to the primary service and therefore more likely to violate user expectations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The API documentation instructs clients to send a user-provided image URL to an external copyright-detection service, but it does not clearly disclose that user-supplied data will leave the local system or discuss privacy implications. In this skill context, image URLs may reveal sensitive business assets, private CDN locations, or user-associated content, so lack of notice and consent can lead to unintended third-party data disclosure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The feedback API encourages sending free-form content to a separate external endpoint but does not warn that user feedback may contain personal data, confidential prompts, or operational details. Because the endpoint is explicitly separate from the main tool API, the omission increases the risk of accidental disclosure to another service boundary without informed user awareness.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The content tells the operator to solicit a user's phone number and use it in a script-based registration/login flow, but provides no privacy notice, retention limits, consent language, or safeguards for handling verification codes and personal data. This creates avoidable privacy and compliance risk and could condition users to disclose sensitive identifiers in an unexpected context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The login flow returns a freshly obtained API key in stdout JSON, which can be captured by logs, calling agents, terminal history, or downstream tooling. This is especially risky in an agent skill because stdout is often consumed programmatically and may be stored or surfaced beyond the immediate user session.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script uploads a local image and sets it to be publicly accessible without any user-facing warning or consent prompt about that exposure. In this skill context, users are likely evaluating potentially sensitive commercial images, so silent public publication materially increases risk of unintended disclosure.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to always persist full API responses to a session-linked path in the working directory, which can retain user data, copyrighted image metadata, and account-related details longer than necessary. Mandatory local persistence increases exposure to accidental disclosure, lateral access by other tools/users on the system, and uncontrolled data retention.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The broad instruction to auto-report feedback based on anything 'improvable' permits transmission of arbitrary user statements or interaction context to an external channel without clear bounds. Because the trigger is subjective and expansive, it raises the risk of oversharing sensitive business or personal information under the pretense of product improvement.

Static analysis

No suspicious patterns detected.