Security audit

睿观-文字商标检测

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised trademark checks, but it also includes under-scoped feedback, credential, billing, endpoint override, and persistence behaviors that users should review carefully before installing.

Install only if you are comfortable sending product listing text and account/authentication data to LinkFox, handling a LinkFox API key, and potentially using the built-in billing workflow. Before use, avoid endpoint override environment variables, do not paste API keys into shared logs or shell history, review what feedback would send externally, and periodically clean local linkfox response/cache files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:163
Finding: Silent Transmission of User Statements and Inferred Intent Through the Feedback API
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ruiguan_text_trademark_detection.py:36
Finding: Environment-Controlled Endpoints Can Receive Authentication Credentials and Sensitive Product Data
Content: View full analysis
str: """Gateway base address: environment variable first, production fallback.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script similarly allows authentication endpoints to be replaced: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFO ...[truncated 3333 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ruiguan_text_trademark_detection.py:61
Finding: Unnecessary Agent and Session Metadata Is Transmitted With Trademark Queries
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onboarding.py:484
Finding: Generated API Keys Are Printed in Full and Recommended for Plaintext Shell Storage
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} API key acquired successfully", file=sys.stderr, ) return 0 return 1 ``` The onboarding documentation recommends placing the key in shell commands and persistent startup files: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis Printing the complete API key to standard output can expose it through Agent transcripts, terminal scrollback, CI logs, command wrappers, debugging systems, or output-capture tools. The recommended shell commands additionally place the key in command history and plaintext startup files. Shell profiles commonly have broad backup, synchronization, plugin, and process exposure. No restrictive ...[truncated 1132 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ruiguan_text_trademark_detection.py:250
Finding: Unvalidated Session Identifiers Permit Path Escape and Cached Results Are Not Isolated by User
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script uses the same unsafe pattern: ```python sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime( ...[truncated 2743 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/onboarding.py:163
Finding: Onboarding Recommends Installing Unpinned Dependencies From the Active Package Index
Content: View full analysis
None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` The original source messages direct users to install: ```bash pip install qrcode pillow pip install requests ``` ### Technical Analysis The project does not provide pinned versions, hashes, a lockfile, or a restricted package-index configuration. Users are instructed to install whichever current releases are returned by the active pip configuration. No malicious dependency is embedded or specifically named in the repository. The risk arises from the uncontrolled dependency resolution process: a compromised package index, malicious mirror, future package compromise, or incompatible release could introduce code that executes during installation or import. ### Attack Path 1. The onboarding script encounters a missing dependency. 2. The user follows the displayed `pip install` command. 3. Pip resolves packages using the current index and configuration without version or hash constraints. 4. A compromised index, mirror, account, or release supplies malicious package content. 5. Package installation hooks or subsequently imported module code execute with the user's privileges. ### Impact Assessment Malicious dependency code would execute with the privileges of the user running pip or invoking the script. It could access files, environment credentials, Agent data, and network resources available to that account. The ...[truncated 218 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 92% confidence
Finding: The code allows service base URLs to be overridden by environment variables and then sends authentication material, SMS-login data, and token-related requests to those computed endpoints via requests.post. In a skill/runtime environment where env vars can be influenced, this can redirect sensitive traffic to attacker-controlled infrastructure and expose access tokens, phone numbers, verification codes, or generated API keys.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 91% confidence
Finding: The gateway URL is also derived from environment-controlled base settings and used in urlopen with the Authorization header populated from LINKFOX_AGENT_API_KEY. If an attacker can alter the environment, API keys and subsequent account, package, or order traffic can be exfiltrated to a malicious endpoint under the guise of normal gateway operations.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/ruiguan_text_trademark_detection.py (reported line 80)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is trademark text analysis, but the detected behavior includes SMS verification, third-party login, API key generation, account/team inspection, subscription listing, order creation, payment initiation, QR-code generation, and payment-status polling. This is a severe description-behavior mismatch that could trick users into authorizing credential handling and financial actions unrelated to the stated task.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
limit: 100

text
## Display Rules 1. **Risk-first presentation**: Always highlight the overall risk level (`textTrademarkRadar`) at the top of results. Use clear language: "Low Risk", "Needs Manual Review", or "High Risk". 2. **Blacklist prominence**: If `blacklistTrademarks` is non-empty, display them first with a clear warning.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file implements account onboarding, SMS authentication, API-key retrieval, plan discovery, ordering, and payment QR generation, which are unrelated to the declared trademark-text detection purpose. Such scope divergence is dangerous because it introduces credential collection and monetization behavior into a skill that users would reasonably expect to perform content analysis only.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The billing and order workflow creates purchasable plans and renders payment QR codes despite no functional need for trademark detection. In this context, hidden purchasing capability materially increases risk of unauthorized charges, deceptive upsell behavior, and abuse of user trust within an unrelated skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill performs SMS-based login, processes verification codes, and generates or retrieves API tokens, none of which are justified by a trademark-screening feature. This effectively turns the skill into a credential-harvesting and account-access mechanism under misleading metadata, making the mismatch especially dangerous.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring promises that writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and then the system temp directory. That mismatch is dangerous because operators and users may rely on the documented storage boundary, while the actual code may place sensitive trademark-analysis data in less controlled locations, increasing exposure to other local users, backup systems, or ephemeral shared environments.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool scope or permissions despite instructions that require access to environment variables, network calls, and file writes. This creates an over-privileged execution model where the runtime may permit capabilities beyond what users expect, increasing the chance of unintended data access or side effects.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill mandates persistent logging of complete API responses to session-scoped project files and sometimes stdout. Because responses can contain user-supplied listing text, risk assessments, and possibly account-related metadata, this creates a durable data exposure path in the workspace and terminal history beyond the immediate task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs automatic feedback reporting under broad conditions without notifying the user what data may be sent. In this context, user listing content, dissatisfaction comments, or workflow details could be transmitted externally without informed consent, creating a privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill sends productTitle and optional productText to an external endpoint but provides no privacy, retention, consent, or data-classification guidance. Because listing text may contain unpublished product details, supplier information, or other sensitive business data, the omission can lead agents to export user-provided content to a third party without adequate notice or safeguards.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 84)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/ruiguan/textTrademarkDetection \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation includes a separate feedback API that is unrelated to the trademark-detection function of the skill. In an agent setting, this creates an unnecessary secondary outbound channel that could be invoked to transmit user content, analysis results, or metadata to another service, increasing data-exfiltration and prompt-injection risk even though the doc warns not to mix endpoints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The onboarding instructions explicitly tell the operator to collect a user's phone number and pass it to an external registration/login script, but they do not require informed consent, describe what service will receive the data, or state how the phone number and verification code will be handled. This creates a real privacy and security risk because the skill normalizes transmission of personal data and OTP-based authentication material to a third-party workflow without clear disclosure or minimization.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enforces an 11-digit phone format and fixed area code +86, and its interface/help text is entirely in Chinese. This imposes a specific language and locale without opt-in or an explicit documented justification in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The login flow returns the API key directly in stdout JSON, which is likely to be captured by agent logs, shell history pipelines, transcripts, or downstream tooling. Exposing long-lived credentials in routine command output increases the chance of inadvertent disclosure and later account compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill sends user-supplied listing content plus session metadata to a remote API without any in-band disclosure or consent mechanism in the execution flow. While remote processing is expected for this type of skill, the absence of explicit notice and metadata minimization makes it a genuine privacy/security weakness, especially because the content being analyzed can include commercially sensitive product drafts and account context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill implements persistent session tracking and local logging infrastructure well beyond simple trademark detection, including session directories, index files, metadata aggregation, and cross-run bookkeeping. In this skill context, that broadens data retention and creates unnecessary privacy and compliance risk because user inputs and API outputs may contain product plans, listings, or infringement-analysis results that are stored long-term without clear need or user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code always writes the full API response to disk before deciding what to print, with no runtime prompt, opt-in, or masking. In this skill context, the response may contain sensitive listing text, suspected trademarks, and compliance assessments, so unconditional persistence increases the chance of unintended local disclosure and over-retention.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction says to default to US whenever the user does not specify a region. This imposes a locale/region choice without explicit user opt-in, which matches the policy category for language or locale constraints applied by default.
Content: No source excerpt is available for this finding.