Back to skill

Security audit

睿观-图形商标检测

Security checks across malware telemetry and agentic risk

Overview

The skill performs trademark screening, but it also handles phone login, API-key setup, paid plan orders, public image uploads, saved responses, and automatic feedback reporting, so users should review it before installing.

Install only if you are comfortable sending product images and related metadata to LinkFox, uploading local images as public URLs, storing full results locally, and using the included phone-login, API-key, and payment workflows. Prefer obtaining and storing API keys through a trusted first-party flow, avoid running onboarding against modified LINKFOX_* endpoint variables, and review saved linkfox output files for sensitive data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
94% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
93% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation directs use of environment variables, local file writes, and network operations, but no explicit permissions or constraints are declared. This creates a capability/expectation gap where an agent may perform sensitive actions such as reading auth material, persisting user-derived data, and contacting external services without clear user-visible authorization boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is graphic trademark detection, but the referenced behavior includes SMS login, API key/token generation, account/team lookup, plan purchase flows, payment QR rendering, order-status queries, and image uploads. Expanding into authentication, billing, and account management greatly increases the attack surface and could enable collection of phone numbers, account metadata, credentials, or purchases unrelated to the user’s immediate request.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill instructs automatic reporting to a separate Feedback API whenever various conditions occur, even though that behavior is outside the primary trademark-detection purpose. This can cause user interactions, results, or dissatisfaction signals to be transmitted to another service without clear necessity, consent, or minimization.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The file embeds account onboarding, API key provisioning, and billing/payment handling inside a skill whose declared purpose is trademark image detection. This expands the skill's authority into credential and payment workflows, creating unnecessary exposure to sensitive data collection, phishing-like behavior, and abuse if the referenced script or surrounding agent flow is compromised.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The instructions actively drive user registration and purchase flows, including collecting phone numbers, sending login codes, obtaining API keys, listing plans, and initiating orders. For a trademark-analysis skill, this is unjustified functionality and increases the attack surface for social engineering, unauthorized account actions, and monetization abuse.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file implements account onboarding, SMS login, API-key retrieval, package listing, ordering, and payment QR generation, which are unrelated to the advertised trademark-image detection function. Such scope mismatch is a strong security concern because it introduces credential handling and commerce operations users would not expect from this skill, increasing the chance of abuse or unauthorized account actions.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The code includes order creation, payment method handling, and QR code generation for purchases despite the skill being described as a trademark-screening tool. Embedding commerce capabilities in an unrelated skill increases the risk of unauthorized charges, social engineering, and hidden monetization paths, especially when invoked in agent environments where users may not inspect code.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill provisions or retrieves API tokens after SMS login and returns them to stdout, which exceeds the needs of a trademark-detection workflow. This creates a credential-issuance path inside an unrelated skill, enabling privilege expansion and secret exposure if the skill is misused, logged, or redirected to attacker-controlled endpoints.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The docstring promises that output will stay in the current project directory and explicitly says writing to /tmp is forbidden, but the implementation falls back to ~/linkfox and the system temp directory. This mismatch can cause sensitive trademark-analysis results to be written to less controlled locations, violating user expectations and potentially weakening data handling guarantees.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The script's actual function is public image upload, while the skill is described as trademark detection and similarity analysis. That mismatch is dangerous because it expands capability beyond the declared purpose, enabling data staging or external hosting of user-supplied product images without transparent justification.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code explicitly sets uploaded objects to public-read and returns a public URL, making user-provided product images accessible to anyone with the link. In a trademark-screening context, this is unnecessary and increases privacy, confidentiality, and data-governance risk, especially if images contain unreleased products, customer assets, or proprietary branding.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The trigger conditions are broad enough to activate on loosely related product-safety or sellability questions, not just explicit graphic trademark analysis requests. Overbroad activation can cause the agent to route unrelated user content into a costly external service, increasing unintended data disclosure and surprise side effects.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The API documentation explicitly supports sending user-provided product images, base64 image data, product titles, and trademark-related metadata to an external service, but it does not disclose retention, logging, sharing, jurisdiction, or consent requirements. In a trademark-screening skill, those inputs may contain proprietary product imagery or pre-launch branding assets, so lack of privacy and data-handling guidance can lead to unintended disclosure or non-compliant processing.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The onboarding flow asks for a user's phone number and then uses scripts to send codes and log in, but it provides no user-facing notice about what data is collected, where it is transmitted, how it is stored, or who operates the endpoint. This creates privacy and consent risks, especially because phone numbers and authentication codes are sensitive account-recovery data.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The CLI is designed to emit JSON to stdout, and the login flow returns api_key in that output. Stdout is commonly captured by logs, wrappers, transcripts, and agent frameworks, so printing a live credential can leak secrets to unintended readers or storage backends. In a skill context, this is more dangerous because execution output may be automatically persisted.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script always writes the full API response to disk, regardless of size or sensitivity, and does so without an explicit runtime warning or opt-in. Because this skill processes product images and trademark-risk results, responses may contain proprietary or compliance-sensitive data that persists locally longer than the user expects.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The request sends user-supplied parameters plus environment-derived metadata such as SESSION_ID, MODE_ID, and APP_NAME to a remote service without a user-facing disclosure at execution time. In this skill context, inputs may include image-derived trademark data and business-sensitive product information, so silent transfer to an external API increases privacy and data-governance risk.

Ssd 3

Medium
Confidence
94% confidence
Finding
The skill requires always writing full API responses to project-local session files, creating persistent local copies of potentially sensitive user inputs, images, account indicators, and analysis results. Persistent storage in the current project directory increases the chance of later exposure through repo inclusion, shared workspaces, backups, or other tools reading those files.

Ssd 3

Medium
Confidence
92% confidence
Finding
The feedback instructions encourage transmitting user content and interaction details to another API under broad conditions, without clear limits on what is shared. This creates a data-leak risk because sensitive prompts, commercial plans, or image-analysis context could be copied into a secondary system unnecessarily.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
79% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.