Seerfar-Ozon市场关键词搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 1.0.5

Overview

The skill can perform keyword searches, but it also handles account login, API keys, paid orders, local storage, and quiet feedback reporting in ways users should review before installing.

Review this before installing. Use it only if you trust LinkFox with your marketplace queries, API key, account identifiers, and any phone/SMS onboarding data you choose to provide. Avoid running payment/order flows unless you explicitly intend to buy credits, verify endpoint environment variables point only to trusted LinkFox HTTPS hosts, and treat any generated API key as a secret rather than leaving it in transcripts or shell startup files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:142

Finding

Silent Transmission of User Feedback to an External Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/seerfar_ozon_market_keyword_search.py:36

Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Endpoints

Content

View full analysis

str: """Gateway base address: environment variable takes priority.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key not configured", file=sys.stderr, ) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Equivalent endpoint override behavior exists in the onboarding flow: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> s ...[truncated 2281 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/seerfar_ozon_market_keyword_search.py:63

Finding

Unnecessary Disclosure of Agent Session and Message Identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:486

Finding

Full API Key Is Printed to Standard Output and Recommended for Plaintext Persistence

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_send_code(args) -> int: r = send_verify_code(args.phone.strip()) _emit(r) if r.get("sent"): print(f"{TAG} verification code sent to {r['phone']}", file=sys.stderr) return 0 if r.get("sent") else 1 def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} successfully obtained API key", file=sys.stderr) return 0 return 1 ``` The onboarding documentation further recommends plaintext persistence in shell startup files: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The complete API key is returned as part of a JSON object and printed to standard output. In an Agent environment, stdout may be captured in: - Conversation transcripts. - Tool-call logs. - Debugging or observability systems. - Terminal scrollback. - Command automation output. - CI job logs. The documentation then encourages users to place the key directly into shell startu ...[truncated 1733 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive onboarding data to them via requests.post. Because this script handles phone numbers, SMS codes, access tokens, refresh tokens, API keys, and payment-related flows, a malicious or misconfigured environment can silently redirect secrets to an attacker-controlled host, resulting in credential theft and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway client uses urlopen on a URL derived from environment variables and attaches the API key in the Authorization header. If the environment is attacker-influenced, all authenticated gateway traffic, including account, package, and order operations, can be redirected to an arbitrary server and the API key exfiltrated.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request sent via urlopen includes multiple headers sourced directly from environment variables, and the destination base URL is also overrideable via LINKFOX_TOOL_GATEWAY. This creates a tainted outbound data flow where secrets and session metadata can be exfiltrated to an attacker-controlled endpoint if the environment is influenced, which is especially risky because the Authorization API key is transmitted on every request.

Content

Scanner excerpt · scripts/seerfar_ozon_market_keyword_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to search keyword metrics, but it also persists full API responses locally, maintains local caches, writes session/date-organized metadata, and may fall back to alternate storage locations. Undeclared persistence increases privacy and data-retention risk because users may not expect market queries, account-linked identifiers, or response payloads to be stored beyond the immediate interaction.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims to search keyword metrics, but it also persists full API responses locally, maintains local caches, writes session/date-organized metadata, and may fall back to alternate storage locations. Undeclared persistence increases privacy and data-retention risk because users may not expect market queries, account-linked identifiers, or response payloads to be stored beyond the immediate interaction.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

3. **Use `keywords` + `matchType` to scope a niche**: pass seed terms in Russian with `matchType: 1` (fuzzy) to enumerate related long-tail terms.
4. **Pick the right `searchDate`**: omit it for current trends (last 30 days); pass an explicit date for month-over-month comparison.

## Display Rules

1. **Present data only**: show keyword metrics in a clear table without subjective advice.
2. **Lead with keyword columns**: `query` / `queryCn` (Chinese translation), then `searchVolume`, `count30GrowthRate`, `productCount`, `sellers`, `avgPrice`.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding document introduces authentication recovery, account registration, and billing/purchase workflows that are materially unrelated to the declared purpose of Ozon/Wildberries keyword analysis. This expands the skill into handling credentials, account lifecycle, and payments, creating an unnecessary trust and attack surface that could enable data collection or unauthorized commercial actions under the guise of a market-research tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented ability to register accounts by phone number and create billing orders is not justified by the skill's stated function of keyword market analysis. When a skill can solicit identity data and initiate purchases outside its expected scope, users may be socially engineered into providing sensitive information or authorizing charges they did not anticipate.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This skill is described as an Ozon/Wildberries keyword research capability, but the code implements a separate onboarding and commerce CLI for login, API-key issuance, subscription purchase, and payment QR generation. That scope mismatch is dangerous because it introduces credential handling and billing behavior users would not reasonably expect from a keyword-search skill, increasing the chance of covert data collection or unauthorized commercial actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file contains plan enumeration, order creation, and payment QR generation even though the skill's stated purpose is keyword market analysis. Commerce and payment capabilities expand the blast radius from data retrieval to financial transactions, creating risk of unintended purchases, user coercion into payment flows, or abuse if the skill is triggered unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring promises that writing to /tmp is forbidden and that an unwritable current directory should cause failure, but the implementation silently falls back to the home directory and then the system temp directory. This mismatch is security-relevant because operators or higher-level controls may rely on the documented behavior to prevent data from being written to less trusted locations, yet the code will still persist sensitive responses there.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool scope even though its documented behavior uses environment variables, filesystem writes, and network access. Missing scope declarations weakens least-privilege controls and makes it easier for a seemingly narrow keyword-search skill to exercise broader capabilities than users or the platform may expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger language is broad enough to activate the skill based on inferred intent even when the user does not explicitly request Seerfar or this specific capability. Over-broad auto-triggering raises the chance of unintended execution of a skill with network, env, and local-write behaviors, especially given the additional hidden onboarding and persistence functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs unconditional writing of full API responses to disk, but does not require upfront user warning or consent about local persistence. This creates a confidentiality and compliance risk because response bodies may contain user-linked identifiers, business data, or account-related metadata that persist in the project workspace.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Persistent logging of full responses in session-scoped project files can expose user-associated activity across tasks and over time. Session/date indexing increases discoverability of accumulated data for later users, tools, or processes with filesystem access, expanding the blast radius beyond the original request.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 134)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/seerfar/ozon/marketKeywordSearch \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes a separate feedback submission API that is unrelated to the primary keyword-search function and sends arbitrary content to a different external service. In an agent-skill context, this expands the skill's data egress surface and can enable unsolicited transmission of user content or conversation-derived data beyond what is necessary for the requested task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly direct collection and transmission of a user's phone number and one-time verification code, but provide no privacy notice, data-handling limits, or warning about the sensitivity of OTPs. This creates a credential-harvesting risk because SMS codes can be used to access or create accounts, and users are not informed of the security implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code performs SMS login, token exchange, user-info retrieval, and API-token generation, which are privileged account-management operations outside the advertised keyword-search purpose. In context, this is more dangerous because the skill can collect authentication factors and mint durable API credentials, enabling persistent access beyond a single search request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI hard-codes mainland China assumptions in user-facing behavior, including requiring an 11-digit phone number and always sending "+86" as the area code. The file-level description and command help do not indicate that this is a China-only skill or offer any language/locale choice, which violates the locale-policy rule for natural-language behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persistently stores full API responses, cache entries, and session metadata on disk under linkfox/, including potentially sensitive business query results and identifiers such as session IDs. This exceeds the core keyword-search behavior described by the skill and increases the risk of unintended local data retention, cross-session data exposure, and forensic leakage from shared workspaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation instructs sending requests and API-key-authenticated data to an external service without any warning that user-supplied search terms and filters leave the local environment. While external API use is expected for this skill, the absence of transparency and consent guidance increases privacy and compliance risk, especially if users provide proprietary market research terms or account identifiers like uId/memberId.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The feedback API section omits a warning that feedback content is sent to a distinct external endpoint from the main tool gateway. Because feedback content may contain free-form text derived from user conversations, this creates an avoidable risk of sending sensitive or unnecessary information to a second service without clear disclosure.

Content

No source excerpt is available for this finding.