Seerfar-Ozon类目搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 1.0.6

Overview

This skill performs Ozon category analytics, but it also adds sensitive account, payment, credential, persistence, and silent feedback-reporting behavior that users should review before installing.

Review this skill carefully before installing. It is not just an Ozon category lookup helper: it can guide users through phone/SMS login, expose and persist API keys, create payment orders, write full responses locally, and silently send feedback to LinkFox. Only use it if you trust LinkFox with the queried data, account setup data, and payment flow, and prefer obtaining/storing API keys through an official account portal or secret manager rather than pasting OTPs or saving keys in shell profiles.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:148

Finding

Silent External Feedback Reporting Alters Agent Behavior

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:484

Finding

API Credential Is Printed to Standard Output and Recommended for Plaintext Persistence

Content

View full analysis

int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key acquired successfully", file=sys.stderr) return 0 return 1 ``` The documentation recommends persisting the credential in shell startup files: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The onboarding process returns the full API key through standard output. Standard output is frequently captured by Agent transcripts, terminal history systems, CI logs, shell pipelines, debugging tools, or process wrappers. This makes the credential available outside its intended authentication boundary. The suggested shell-profile configuration stores the key as plaintext in `.zshrc` or `.bashrc`. The instructions do not verify file ownership or permissions and do not recommend an operating-system secret store. Shell startup files may also be included in backups, support archives, synchronization systems, or diagnostic bundles. Printing the key is not necessary after secure storage has been completed. Returning a masked ...[truncated 1225 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:171

Finding

Unpinned Runtime Dependencies Are Recommended in a Credential-Handling Workflow

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The code sends authentication material and user data to URLs whose base domains can be overridden by environment variables. In a skill execution environment, an attacker who can influence env configuration can redirect SMS login, token exchange, or API-key generation traffic to attacker-controlled endpoints and capture access tokens, refresh tokens, phone numbers, and issued API keys. The fact that this file is an onboarding/authentication utility rather than an Ozon analytics client makes the exposure more dangerous because it handles high-value credentials unrelated to the declared skill purpose.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The gateway request path builds a request URL from environment-controlled base URLs and then sends the bearer API key in the Authorization header via urlopen. If an attacker can set LINKFOX_AGENT_API_URL or related variables, they can exfiltrate the agent API key and steer order, package, or account queries to a malicious service. In this skill context, that is especially risky because the code performs billing and account operations that have no justified relation to Ozon category search.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/seerfar_ozon_category_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is category-product analytics, but the implementation reportedly includes phone login, SMS verification, API key generation, account/team queries, plan listing, payment order creation, QR rendering, and payment-status checks. This is a major capability expansion into authentication and billing flows, exposing users to credential handling, account actions, and payment operations unrelated to the stated task.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

5. **Use `date` for historical comparison**: pass `date` as `yyyy-MM` to compare a past month against the current 30-day window.
6. **`fulfillment` is a single string**: pass one of `FBO` / `FBS` / `RFBS` / `FBP` / `OZON`, not an array.

## Display Rules

1. **Present data only**: show the category aggregates and product metrics in a clear table without subjective advice.
2. **Lead with category context, then product columns**: state the category name (from `categoryInfo.cnTitlePath` / `enTitlePath` — confirms the right category), then `totalSales`, `totalRevenue`, `avgPrice`, `rating`, seasonality (`seasonalityAmplitude` / `seasonalityCoef`) and date range, plus the fulfillment distribution (`sellerType` map) as a one-line FBO/FBS/RFBS/... split; then a table of `sku`, `title`, `price`, `sales`, `revenue`, `reviewRating`, `reviewCount`, `brandName`, `sellerName`.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements account onboarding, SMS verification, login, plan purchase, and payment flows, but the declared skill is for Ozon category product analytics. This severe mismatch suggests the skill bundles unrelated privileged behavior, increasing the chance of deceptive credential collection or unauthorized monetization under the guise of analytics. Context makes this more dangerous because users invoking an analytics skill would not reasonably expect telecom-auth and payment operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code can enumerate purchasable plans, create orders, and render payment QR codes, none of which are justified by the declared Ozon category search capability. This introduces unauthorized billing surfaces and creates a path for social engineering users into making payments they did not intend when requesting analytics. In context, payment behavior hidden inside a data-analysis skill is a strong abuse indicator.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This section implements SMS-based login, token exchange, team/user info retrieval, and API key generation, which are highly privileged account functions unrelated to category analytics. Embedding credential issuance inside an unrelated skill can enable phishing-style collection of phone numbers and verification codes, followed by silent extraction of API keys for downstream abuse. Given the misleading skill description, the mismatch substantially raises suspicion beyond ordinary negligence.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation explicitly says writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and then the system temp directory. This mismatch is dangerous because operators may rely on the documented storage guarantees when handling potentially sensitive API responses, yet the data can be written to a less controlled or shared location instead.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises capabilities that require environment access, file writes, and network use, but it does not declare any explicit tool scope or permission boundaries. That creates an over-privileged execution surface where sensitive operations may occur implicitly, making review, sandboxing, and least-privilege enforcement harder.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are broad and allow invocation based on inferred intent even when the user did not explicitly request this specific skill. In a paid, networked skill that can persist data locally, over-broad activation increases the chance of unnecessary external calls, unintended data access, and surprise cost-incurring behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level description is written as a directive in Chinese and frames activation and behavior around Chinese-language phrasing, while the document does not state that language choice should follow the user's preference. Forcing or assuming a specific language without opt-in can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to always write the full response to local session-organized files. Those responses may contain user-linked identifiers such as uId, memberId, category analytics data, and account-related metadata; persistent local storage increases risk of unintended retention, lateral exposure to other tools/users on the host, and data leakage from the workspace.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 135)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/seerfar/ozon/categorySearch \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The onboarding flow explicitly instructs collecting a user's phone number and verification code to register/login, but provides no privacy notice, consent language, retention limits, or handling safeguards for that personal data. In an agent skill context, this is risky because users may disclose sensitive identifiers and OTPs to the agent/operator without understanding how they are processed or stored.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language behavior embedded in the CLI only accepts 11-digit phone numbers and hard-codes the area code to +86, which effectively restricts use to a specific locale. The file does not provide an opt-in language/locale choice or a clear justification that this is intentionally a China-only regional skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline comment says responses below the threshold are '直接全量输出，不落文件', but main() always resolves an output path and writes the full serialized response before deciding whether to print inline or summarize. This is an active contradiction between the code comment and actual behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script persistently caches full API responses on disk under a deterministic path and later reuses them for up to 24 hours. Because the skill handles category/product data and may also include response metadata or account-scoped content, this creates undeclared local data retention that can expose prior query results to other local users, later tasks, or unintended tooling within the same workspace.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code maintains per-session directories, _meta.json files, index.jsonl, and archived response files across runs, which extends behavior beyond a simple category-search skill into local activity tracking and persistent output indexing. This broadens the privacy and exposure surface by recording session identifiers, timestamps, invoked skills, and file locations in a structured way that could reveal user behavior and historical work products.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

_resolve_output_path documents that outputs go to <cwd>/linkfox/..., but it delegates to resolve_data_path, which uses _linkfox_root and may place files under ACPX_WORKSPACES, ~/linkfox, or $TMPDIR/linkfox. The docstring therefore materially misstates where data is written.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The parameters section states that fulfillment must be a single string and explicitly says it is not an array (L032), but the display rules claim fulfillment is an array and instruct joining multiple values with / (L106). This is an internal documentation contradiction about the skill's data model and could cause incorrect downstream handling of the response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The document title and all operational instructions are written in Chinese, presenting the skill documentation in a single language with no indication that users may choose another language. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.