睿观-文字商标检测

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.6

Overview

The skill does perform trademark checks, but it also handles login, API keys, payment ordering, feedback reporting, and local data retention in ways users should review before installing.

Install only if you are comfortable sending product titles/descriptions to LinkFox/Ruiguan and using this skill for LinkFox account, API-key, and payment-credit workflows. Avoid pasting secrets or customer personal data into listing text, prefer the provider's self-service account portal when possible, treat printed API keys as sensitive, and clean up saved linkfox response/cache files when they are no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from helper functions that read environment variables, so a hostile or misconfigured environment can redirect requests to attacker-controlled infrastructure. Because these requests can carry SMS-login data, access tokens, refresh tokens, and generated API keys, this creates a real credential exfiltration and SSRF-style risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The urllib request destination is also built from environment-controlled base URLs, enabling an attacker controlling the runtime environment to reroute authenticated gateway traffic. Since the Authorization header includes the LinkFox API key, this can leak secrets and permit requests to unintended internal or external services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require reading environment variables, making network requests, and writing files locally. This mismatch prevents informed review and consent, and it obscures the real data-handling and execution surface of the skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a trademark detection tool, but the documented behavior extends into login, API key generation, package lookup, order creation, payment QR generation, and payment-status polling. That is a major scope expansion involving authentication and payment workflows unrelated to the user’s stated task, increasing risk of credential collection, unexpected charges, and privacy exposure.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill instructs automatic feedback reporting whenever the user shows satisfaction, dissatisfaction, or whenever the tool could be improved, which is unrelated to the core trademark-check function. This creates an undisclosed secondary data flow that may transmit user content or behavioral signals to another API without a clear need-to-know basis.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file embeds account onboarding, authentication recovery, and billing workflows inside a skill whose stated purpose is trademark-risk analysis for product text. That mismatch expands the skill's effective scope into credential handling and payment guidance, creating unnecessary opportunity for data collection, social-engineering, and unauthorized account or purchase actions if surfaced to users.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documentation instructs operators to collect phone numbers, run registration/login flows, provision API keys, and initiate payment orders, none of which are justified by a trademark-scanning function. In context, this is dangerous because it normalizes sensitive account operations within an unrelated skill, making abuse or accidental mishandling of user identity, secrets, and funds more likely.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS verification, API key acquisition, package purchase, and payment flows, which are materially unrelated to a trademark-text detection skill. This mismatch is dangerous because it expands the skill's capability into credential collection and account operations under a misleading description, increasing the chance of unauthorized data handling or social engineering.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing and payment-order creation are not justified by the stated purpose of trademark-risk analysis. Embedding purchase and QR payment generation in an unrelated skill can facilitate unauthorized charges, hidden monetization, or deceptive user flows.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code performs SMS-based login, token exchange, team discovery, and API-token generation despite the skill being advertised for trademark text analysis. In this context, collecting phone numbers, verification codes, and issuing API keys is an unjustified privilege escalation and creates clear credential-harvesting risk.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to activate on loosely related listing-compliance or text-check requests, even when the user did not ask for trademark scanning. Overbroad activation can cause unnecessary external data transmission, unwanted costs, and analysis of user content under a tool the user did not intentionally invoke.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly instructs sending productTitle and optional productText to a third-party remote endpoint, but it provides no warning about data transmission, confidentiality, or restrictions on including sensitive seller or customer information. In a listing-compliance skill, users may paste draft listings, brand strategy text, or proprietary product copy, so the omission can lead to unintended external disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs obtaining a user's phone number and submitting it to a script for sending codes and login, but provides no privacy disclosure, retention limits, or consent language. This creates privacy and compliance risk because personally identifiable information is being collected and transmitted through an operational script in a context unrelated to the core trademark-analysis task.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The login command prints a newly obtained API key to stdout JSON, which is commonly captured by logs, calling frameworks, transcripts, or other plugins. Exposing long-lived credentials this way can lead to account compromise if any downstream system records or displays command output.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill requires always writing the full API response to session-linked local files in the working directory, which can retain user-provided listing text, trademark matches, and related metadata beyond the immediate task. Persistent local storage increases the chance of later disclosure to other tools, users, or processes in the same project environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This code transmits data to external services, including authentication-related payloads and token operations. External transmission is expected for networked functionality, but in this skill it becomes dangerous because the transmitted data includes sensitive credentials and the skill's declared purpose does not justify those flows.

Static analysis

No suspicious patterns detected.