Seerfar-Ozon店铺搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.5

Overview

The skill performs the advertised Ozon seller search, but it also bundles sensitive account, API-key, billing, feedback, and local-retention behavior that should be reviewed before use.

Install only if you are comfortable with LinkFox receiving API keys, phone numbers, SMS codes, account data, and paid-order requests during onboarding or quota resolution. Use it in a trusted workspace, avoid setting endpoint override environment variables unless you control the destination, expect full search results to be saved locally, and treat the feedback feature as an outbound data path that should be disabled or explicitly consented before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material such as access tokens, API keys, phone numbers, and SMS codes to those endpoints via requests.post. If an attacker can influence environment variables, this becomes credential exfiltration or SSRF-to-attacker infrastructure, and the risk is amplified because this onboarding script handles login and token issuance rather than the advertised Ozon shop-search function.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway client uses environment-derived base URLs with urlopen and attaches the LINKFOX agent API key in the Authorization header, so a modified environment can redirect privileged requests to an attacker-controlled server. This enables exfiltration of API credentials and possibly internal network access, especially because the script also performs order creation and account operations unrelated to the stated skill purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require access to environment variables, outbound network calls, and local file writes. This creates a capability-transparency gap: users and the host agent may invoke a seemingly simple analytics skill without realizing it can persist data locally and use credentials from the environment. In this context, the hidden file-write and network behaviors are especially risky because the skill also handles paid API usage and account-related flows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is shop-product lookup, but the broader behavior includes authentication, API key generation/retrieval, account inspection, plan purchase flows, payment order creation, QR rendering, order-status checks, and filesystem persistence. That is a major scope expansion into sensitive account and billing operations, which could cause credential exposure, unauthorized charges, or surprise account actions under the guise of a search skill. The mismatch makes informed consent and safe routing impossible.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file documents a separate feedback-submission endpoint that is outside the stated shop-search capability, which expands the skill's effective action surface beyond user-expected behavior. In an agent setting, this can enable unsolicited outbound data transmission to a second service, including user prompts, results, or metadata, creating privacy, consent, and data-exfiltration risks even if the endpoint appears legitimate.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements an onboarding and commerce CLI for LinkFox accounts, including login, API-key issuance, plan listing, purchasing, and order queries, which is materially unrelated to an Ozon shop product search skill. Such scope divergence is dangerous because it collects credentials and enables account/payment actions under the cover of an unrelated skill, increasing the chance of unauthorized or deceptive operations.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can create paid orders and generate payment QR codes, a financial action that has no clear relation to searching Ozon seller products. In the context of a marketplace-analysis skill, hidden commerce capabilities are especially risky because they can trigger unexpected charges or social-engineer users into payments.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script performs SMS login, token exchange, team discovery, and API-token generation, all unrelated to the declared Ozon store analysis purpose. In this context, collecting phone numbers and verification codes is highly sensitive and can be used to hijack accounts or mint API credentials beyond what a search skill should ever need.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill is presented as a shop-product search utility, but it persistently stores full API responses and session metadata on local disk. This creates an undisclosed data retention surface that may expose business-sensitive search results, seller analytics, and session linkage information to other local users, tooling, or later processes.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module documentation explicitly says writing to /tmp is forbidden and that failure to write the current directory should error, but the implementation silently falls back to the home directory and then the temporary directory. This contradiction can cause data to be written to less secure locations than expected, increasing the chance of unintended disclosure of API results and session metadata.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The comment states small responses are output directly without file persistence, but the code always serializes and saves the full response before deciding what to print. This is dangerous because operators may rely on the documented behavior and unintentionally persist data they expected to remain ephemeral.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger logic is overly broad and instructs activation whenever the user appears to want any Ozon shop or seller product/sales data, even without naming the tool. Broad triggers increase the chance this paid, networked, data-writing skill is selected when a safer or more appropriate tool should be used, leading to unintended API consumption, unnecessary data collection, or execution of the skill's wider side effects. Given the skill's hidden account/billing behaviors, mis-triggering is more dangerous than usual.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The onboarding instructions direct the operator to collect a user's phone number and SMS verification code and pass them to a script, but they provide no privacy notice, consent language, or warning about how those credentials are transmitted, stored, or handled. This creates a real risk of exposing sensitive authentication data and enabling account takeover or mishandling of personal data, especially in an agent workflow where users may assume the process is fully trusted.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script always writes the full API response to disk and does so without any consent prompt or explicit user-facing warning in the execution flow. In the context of competitor and seller analytics, these responses may contain commercially sensitive data whose silent retention increases privacy and data governance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 85% confidence
• Finding: This is an actual external transmission of sensitive data to remote services, including phone numbers, SMS codes, access tokens, and account metadata. External transmission is not inherently malicious, but in this skill it is more dangerous because the networking supports unrelated onboarding/account functions and can combine with environment-controlled endpoints to leak secrets.

Static analysis

No suspicious patterns detected.