Seerfar-Ozon关键词反查

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:42 PM UTC
• Version: 1.0.4

Overview

The skill performs the advertised keyword lookup, but it also includes account-login, API-key, payment-order, automatic feedback, and persistent data-saving behavior that deserves review before installation.

Install only if you trust LinkFox/Seerfar with SKU lookup data, account onboarding, and billing support. Expect it to use a LinkFox API key from environment variables, save complete API responses under local linkfox directories, optionally collect a phone number and SMS code for onboarding, output a usable API key, create unpaid payment orders/QR codes when directed, and send feedback to a separate feedback endpoint. Avoid using the phone, login, payment, or feedback paths unless you intentionally want those actions, and treat generated API keys and saved response files as sensitive.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and the function sends authentication material, login payloads, and token-management requests to that destination. If an attacker can influence environment variables in the runtime, they can redirect sensitive SMS-login, access-token, and API-key traffic to an attacker-controlled host, causing credential exfiltration and server-side request forgery behavior.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request path uses an environment-derived base URL and automatically attaches the API key in the Authorization header before calling urlopen. A manipulated environment can therefore redirect privileged API traffic and credentials to an attacker-controlled endpoint, exposing the agent API key and enabling unauthorized use of the linked account.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions while instructing use of environment variables, network API calls, and persistent file writes to the current working directory. That mismatch undermines least-privilege review and can hide sensitive behaviors such as credential access and data exfiltration behind an apparently simple analytics skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a keyword reverse-search tool, but the referenced behavior includes account login, SMS code handling, token/API-key issuance, account lookup, subscription purchase, payment QR generation, and order-status queries. Mixing commerce, authentication, and payment operations into a data-retrieval skill creates a severe trust-boundary violation and raises the risk of credential harvesting, unauthorized purchases, or user confusion leading to unintended financial actions.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file for a SKU keyword reverse-lookup skill embeds a second, unrelated Feedback API with a different base URL and posting semantics. In an agent setting, this expands the skill’s effective capability surface beyond the declared purpose and can cause unintended outbound data transmission, including user content or execution metadata, to another service if the agent follows the documentation literally.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a broad onboarding and commerce workflow—SMS login, token issuance, plan listing, ordering, and payment QR generation—that is unrelated to the declared Ozon keyword reverse-search purpose. That mismatch increases risk because the skill requests and handles far more sensitive capabilities and data than necessary, expanding the attack surface and enabling credential capture or monetization flows under a misleading skill description.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill can create orders, query payments, and render payment QR codes, which are billing capabilities unrelated to keyword analytics. In the context of a search-analysis skill, embedding purchase flows is especially dangerous because it could steer users into unexpected financial transactions and exposes payment-related identifiers and artifacts without clear necessity.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code performs SMS-based authentication, fetches user/team details, and generates or retrieves API tokens, going far beyond the advertised keyword reverse-search function. In this skill context, collecting phone numbers and issuing reusable API keys is disproportionately sensitive and creates a credible path to account takeover or long-term unauthorized API access if mishandled.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs the agent/operator to collect a user's phone number and pass it to a registration/login script, but it provides no privacy notice, consent language, retention guidance, or handling restrictions for this personal data. In a support workflow, this creates unnecessary privacy and social-engineering risk because users may be encouraged to disclose sensitive contact data directly to an automated system without clear safeguards.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The login flow returns a usable API key directly in the command output, and the file provides no inline warning, consent gate, or storage-handling guidance. Exposing sensitive credentials in normal output increases the chance of leakage through logs, transcripts, shell history, or downstream tooling, especially in agent environments where outputs may be captured automatically.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The order flow writes QR code images to disk in a session directory without explicit disclosure in the code path. While the QR content is payment-related rather than arbitrary code execution, persisting payment artifacts on disk can leave behind sensitive transaction links or metadata accessible to other local users or later processes.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script always persists full API responses to disk and may print complete small responses to stdout, yet gives no user-visible warning that returned data may contain sensitive business information, identifiers, or account-linked metadata. In an agent environment, stdout and workspace files are often broadly visible to logs, other tools, or subsequent tasks, increasing the chance of unintended data exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This code transmits externally over the network using requests.post as part of login and token workflows, including potentially sensitive authentication data. In combination with environment-overridable endpoints and credential-bearing headers, the external transmission is materially risky because it can exfiltrate secrets or user identifiers to unintended destinations.

Static analysis

No suspicious patterns detected.