Seerfar-Ozon类目搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.5

Overview

This skill mostly performs the advertised Ozon category lookup, but it also includes high-impact account, API-key, billing, payment, feedback, and local retention flows that deserve manual review before installation.

Install only if you are comfortable giving this LinkFox skill network access, a LinkFox API key, local storage of full API responses, and optional account/billing flows. Do not hand phone numbers, SMS codes, or payment actions to an agent unless you explicitly intended to onboard or recharge the LinkFox account, and review or restrict endpoint environment variables before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The code builds destination URLs from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, group IDs, and generated API tokens via requests.post. If an attacker can influence environment variables in the host or packaging context, they can redirect these authenticated requests to an attacker-controlled endpoint and exfiltrate credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway helper constructs requests to a URL derived from environment variables and attaches the LINKFOX agent API key in the Authorization header. An attacker who can control the environment can redirect the urllib request to a malicious server and capture the API key or manipulate downstream order and account operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while its documented behavior clearly relies on environment variables, network access, and persistent file writes. This undermines informed consent and review, because operators may enable a skill without understanding that it can exfiltrate data over the network or retain API responses on disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is presented as a category-search analytics tool, but the documented behavior also includes account login, SMS verification, API key acquisition, billing/package lookup, order creation, QR-code payment generation, and payment status queries. Mixing commerce, authentication, and payment flows into a data-query skill creates a serious trust-boundary violation and increases the risk of credential handling, unauthorized purchases, or social engineering under misleading pretenses.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file documents a separate Feedback API that is unrelated to the skill’s stated category-search function, which expands the skill’s effective capability beyond user expectations. In an agent setting, this can enable unintended outbound data transmission such as sending user content or operational details to a second endpoint, creating privacy, policy, and prompt-injection risk if the agent treats all documented APIs as approved actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements an onboarding, login, token-generation, package, and payment CLI that is unrelated to the advertised Ozon category search skill. That mismatch is dangerous because it expands the skill's privileges into credential collection and monetization flows users would not reasonably expect from a product analytics skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders, fetch payment URLs, and render payment QR codes, which is unjustified for a category analytics skill. Embedding purchase capabilities inside an unrelated skill creates a strong risk of unauthorized billing workflows, deceptive monetization, or abuse of existing credentials.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The SMS login and API-key provisioning flow collects phone numbers and one-time codes, exchanges them for access tokens, and generates reusable API keys. In the context of an Ozon category search skill, this is a severe overreach that can enable credential theft, account takeover, and persistence beyond the one-time login flow.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script persistently stores full API responses plus session metadata on local disk, which expands the skill from simple category lookup into local data retention. Because the response includes product and marketplace data and the metadata records session activity, this creates unnecessary data-at-rest exposure and can leak user query history or sensitive business research within the workspace.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that failure to write the current directory will cause an error, but the implementation silently falls back to home and temp directories. This mismatch can cause data to be written into less expected or less protected locations, undermining operator assumptions about where potentially sensitive output will reside.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger conditions are overly broad and instruct activation whenever the user appears to want any Ozon category product view, even without explicitly invoking this skill. In a paid, networked skill that can log data and potentially route into onboarding/billing flows, over-triggering can cause unintended external calls, extra charges, and unnecessary exposure of user queries to third-party services.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document instructs operators to collect and process a user's phone number and one-time verification code through a script, but provides no privacy notice, consent guidance, retention limits, or warning about the sensitivity of this data. This creates a real risk of mishandling personal data and account takeover–adjacent secrets, especially because OTPs are authentication factors and should be treated as highly sensitive.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The code writes payment QR images to local storage under workspace, home, or temp directories without any in-file notice or retention controls. These files may persist and be accessible to other local users, leaking payment links or transaction metadata in environments where skills run on shared hosts.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The skill transmits highly sensitive data including phone numbers, SMS verification codes, access tokens, refresh tokens, and order-related data to remote services, yet this file contains no direct user-facing warning or consent checkpoint. In a skill whose stated purpose is category analytics, the lack of disclosure materially increases the risk of deceptive data collection.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill mandates persistent storage of full API responses in session-scoped files under the working directory. Those responses may contain user-linked identifiers, business data, or account metadata, and retaining them beyond the immediate task increases the blast radius of local compromise, accidental commit, or cross-session access.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill instructs automatic feedback reporting based on user praise, dissatisfaction, or intent mismatch without interrupting the flow. That can transmit user-provided content and interaction metadata to another API without explicit consent, creating a privacy and transparency problem and potentially leaking sensitive business context.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 86% confidence
• Finding: This code performs external transmission of sensitive authentication and account data to remote endpoints. External transmission is expected for login flows, but in this skill it is still dangerous because the functionality is unrelated to the claimed Ozon analytics purpose and combines with environment-overridable endpoints to raise exfiltration risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.