T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:165- Finding
Automatic Transmission of User Feedback Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Seerfar-Ozon商品报表
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches an Ozon product-search purpose, but it also includes under-scoped credential, billing, payment, automatic feedback, and local persistence behaviors that users should review before installing.
Install only if you are comfortable giving LinkFox account credentials/API keys to this skill, having product-search results cached locally, and manually controlling any onboarding or payment steps. Do not let it auto-submit feedback or create purchase orders without seeing and approving the exact payload/action, and avoid storing API keys in shell startup files when possible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/seerfar_ozon_product_report_search.py:36- Finding
Environment-Controlled Endpoints Can Redirect Credentials and Authentication Data
- Content
View full analysis
str: """Gateway base address: LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH ``` The API key and execution metadata are then sent to that endpoint: ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding destinations are independently configurable: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` The generic ...[truncated 3031 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/onboarding.py:474- Finding
Generated API Key Is Printed and Recommended for Plaintext Persistence
- Content
View full analysis
dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: invalid phone format: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: invalid verification-code format: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token(lg["access_token"], lg["user_id"], info["group_id"]) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The entire object is printed to standard output: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key obtained successfully (source: {r['source']})", file=sys.stderr) retur ...[truncated 1925 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/seerfar_ozon_product_report_search.py:251- Finding
Unsanitized Session Identifier Allows Output Path Traversal
- Content
View full analysis
str: """Prefer env SESSION_ID; otherwise generate a stable process-local ID.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] ``` It inserts the value directly into a filesystem path: ```python def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The resulting path is used for response files: ```python def resolve_data_path(slug: str, ts: float, ext: str = "json") -> str: _, session_dir = _ensure_session(ts) sub = os.path.join(session_dir, "data") os.makedirs(sub, exist_ok=True) out = os.path.join(sub, f"{slug}-{int(ts * 1_000_000)}.{ext}") _update_meta(session_dir, skill=slug, kind="data", file_rel=os.path.relpath(out, session_dir), ts=ts) return out ``` ```python out_path = _resolve_output_path(ts) try: with open(out_path, "w") as f: f.write(serialized) ``` The onboarding script uses the same unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) ...[truncated 2063 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/onboarding.py:163- Finding
Unpinned Runtime Dependency Installation Instructions
- Content
View full analysis
dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The Skill recommends installing `qrcode`, `pillow`, and `requests` without: - Exact version constraints. - Package hashes. - A reviewed lock file. - A controlled package index. - An isolated virtual environment. Consequently, installation behavior is not reproducible and may change as packages or transitive dependencies are updated. Python package installation can execute build backend and installation logic, so the dependency installation step expands the code-execution trust boundary beyond the audited project. The package names shown are established package names, and the audit found no direct evidence that they are malicious. The vulnerability is the unpinned and uncontrolled installation process, not a confirmed malicious package. ### Attack Path 1. The user runs onboarding without one of the optional dependencies installed. 2. The script directs the user to execute an unrestricted `pip install` command. 3. pip resolves the latest available package versions and their transitive dependencies from the configured package index. 4. Package build or installation code runs with the user's privileges. 5. A compromised future release, package-index compromise, malicious mirror, or dependency substitution could execute code on the system. ### Impact Asse ...[truncated 472 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (27)
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The code constructs destination URLs from environment-controlled base URLs and then sends authentication material, login data, or API-token-related requests to those endpoints via requests.post. If an attacker can influence environment variables in the skill runtime, they can redirect sensitive traffic to attacker-controlled infrastructure, causing credential exfiltration and account compromise.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 94% confidence
- Finding
The gateway URL is derived from environment variables and used in urllib.request.urlopen with an Authorization header sourced from API keys. An attacker who controls the environment can reroute these requests to a hostile server and capture the bearer token, enabling unauthorized access to the victim's account or billing actions.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This is a strong description-behavior mismatch: a product-report search skill reportedly also performs phone-based login, API key retrieval/generation, account inspection, plan listing, order creation, payment QR rendering, and payment status queries. Hidden auth, billing, and account-management flows materially expand the trust boundary and could enable unexpected charges, credential handling, or disclosure of sensitive account information under the guise of a harmless data-query skill.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md 4. **Use `creationDate` + `labels` for fresh demand**: `creationDate: 1` (new listings) paired with `labels: [2]` (best-seller badge) finds breakout products. 5. **Pick the right `searchDate`**: omit for current trends (last 30 days); pass an explicit date for month-over-month comparison. ## Display Rules 1. **Present data only**: show product metrics in a clear table without subjective advice. 2. **Lead with product columns**: `title`, `sku`, `price` (₽), `sales`, `revenue`, `rating`, `reviewCount`, then `brand` / `sellerName` / `fulfillment`.
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md 示 JSON 里的 phone/agreements - 收到验证码后：`python scripts/onboarding.py login <phone> <code>` - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file is an account-onboarding and payment CLI, not an Ozon product report search implementation as declared in the skill metadata. This mismatch is dangerous because users or reviewers may grant permissions and trust based on the advertised analytics purpose while the code actually performs authentication, token issuance, and commerce-related actions.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code can create purchase orders and generate payment QR codes, which is unrelated to Ozon product screening and can trigger financial transactions. In the context of a product-analysis skill, hidden purchasing capability substantially increases the risk of deceptive billing, unauthorized charges, and user manipulation.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script performs SMS-based login, token exchange, user/team discovery, and API key generation despite the skill claiming to search Ozon product reports. This can be used to harvest or mint credentials under false pretenses, especially because the declared context gives no legitimate reason to collect phone verification codes or return API keys.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares no explicit tool scope or permission boundaries even though it is documented to use environment variables, network access, and file writes. In an agent setting, missing scope declarations can let the runtime grant broader capabilities than users expect, increasing the blast radius if the skill is misused or if hidden behaviors are later introduced.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The section title and instructions specify handling authentication and quota issues via referenced onboarding guidance entirely in Chinese, and the file overall mixes English with mandated Chinese-language operational text. This creates a locale/language policy concern because the skill does not explicitly offer the user a language choice or opt-in before using a specific language for support flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation instructs clients to send an authorization key and optionally user/member identifiers to an external service, but provides no guidance on minimization, redaction, storage limits, or user-consent boundaries. In an agent ecosystem, that omission can lead to over-collection or unsafe propagation of secrets and identifiers into logs, telemetry, or third-party requests.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
}
text ## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/seerfar/ozon/productReportSearch \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The onboarding flow instructs operators to collect a user's phone number and use a local script to send it to an external registration/login service, but it does not clearly disclose that personal data will be transmitted off-platform or explain consent/privacy implications. In a support automation context, this can lead to unnecessary collection of personally identifiable information and social-engineering risk, especially because users may feel pressured to share their number with the agent rather than self-service.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring openly describes a LinkFox onboarding CLI, contradicting the advertised Ozon product-report-search intent. This inconsistency is a strong indicator of repurposed or deceptive code and raises the likelihood that the skill is attempting to smuggle unrelated account and billing behavior into a benign-seeming context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and user-facing CLI help/messages are presented in Chinese only, which enforces a specific language/locale without any opt-in or alternative. Under the stated policy, forcing a language without offering user choice is a natural-language policy violation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 81% confidence
- Finding
The code transmits sensitive onboarding and authentication data to external services, including phone numbers, verification codes, tokens, and related account information. External transmission is especially concerning here because the skill context is unrelated to account onboarding, making the data flows unexpected and more likely to violate user trust or facilitate credential misuse.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function returns a generated or retrieved API key directly in stdout JSON without any in-band warning, masking, or secure storage guidance. In agent and CLI environments, stdout is often logged, persisted, or surfaced to other components, so this can leak long-lived credentials beyond the intended recipient.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language documentation and usage notes are written entirely in Chinese, describing the behavior and outputs without indicating that the user may choose another language. Under the stated policy, forcing a specific language without opt-in can be a locale/language policy violation unless clearly justified as region-specific.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation states that writing to /tmp is forbidden and that failure should occur if the current directory is not writable, but the implementation silently falls back to home and temp directories. This mismatch can cause sensitive output to be persisted in locations the operator did not approve or monitor, weakening data handling guarantees.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill transmits session and application metadata headers along with the authenticated API request without any explicit runtime notice or user-consent mechanism. Although such headers can be operationally useful, they may expose correlation identifiers and workspace/app context to the remote service beyond what the user expects for a product report query.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code caches full API responses on disk for 24 hours under a predictable local path, which exceeds the core product-search function and may retain sensitive business data longer than necessary. If the response contains account-linked analytics, seller info, or other proprietary results, local users or later processes could access stale data without re-authenticating.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill writes full response archives plus session metadata, index entries, and usage history to disk, creating a broader audit trail than the user likely expects from a search/report tool. This expands the local data footprint and can expose session identifiers, usage patterns, and raw API results to other local actors or future tasks.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill for searching and filtering Ozon product report data, but this file also documents a separate Feedback API used to submit sentiment/category/content back to LinkFox. Collecting and sending feedback is not an obvious requirement of product screening itself and represents an extra capability outside the declared user-facing purpose.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The QR rendering function saves a PNG file to a session directory, and the order flow calls it automatically after creating an order. While the code returns the file path, there is no explicit warning in the command help or nearby user-facing disclosure that invoking the command will create files on disk.
- Content