卖家精灵-市场调研（列表）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.9

Overview

The skill can do SellerSprite market research, but it also handles login credentials, API keys, billing orders, payment QR codes, automatic feedback reporting, and broad local/network data flows that need review before use.

Install only if you are comfortable with this skill sending market-research inputs and session metadata to LinkFox/SellerSprite services, handling LinkFox account login and billing flows, and writing full results locally. Avoid using endpoint override environment variables, do not paste SMS codes unless you intend to link the account, confirm any order before payment, and store API keys in a proper secret manager rather than shell startup files or logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:106

Finding

Silent Feedback Transmission and Agent Instruction Hijacking

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sellersprite_market_research.py:36

Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Endpoints

Content

View full analysis

str: """Gateway base address: environment override, otherwise production.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` Onboarding applies the same pattern to more sensitive authentication flows: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com", ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Credential-bearing requests include: ```python resp = _http_post(f"{_agent_user_base()}/a ...[truncated 2349 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sellersprite_market_research.py:207

Finding

Unsanitized Session Identifier Enables Path Escape and Undocumented Temporary-Directory Writes

Content

View full analysis

str: cached = _SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) import tempfile candidates.append(os.path.join(tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _SESSION_CACHE["_root"] = root return root ``` ```python def _session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` ...[truncated 1980 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:457

Finding

Generated API Key Is Exposed Through Standard Output and Plaintext Shell Profiles

Content

View full analysis

dict: hdr = _headers( "agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id, ) for path, source in ( ("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated"), ): resp = _http_post( f"{_agent_user_base()}{path}", {"id": group_id}, hdr, ) if "_error" in resp: return { "error": ( f"{path.rsplit('/', 1)[-1]}: " f"{resp.get('_body') or resp['_error']}" ) } tok = _extract_token(resp) if tok: return {"api_key": tok, "source": source} ``` ```python return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: print( f"{TAG} API key obtained successfully " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` The onboarding documentation recommends permanent plaintext storage through commands equ ...[truncated 1802 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Runtime Instructions Install Unpinned Third-Party Dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return { "png_path": None, "ascii_qr": None, "error": err, } ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; run: pip install requests" ) ``` ### Technical Analysis The runtime error guidance instructs users to install mutable package names without exact versions, hashes, a lock file, or a specified trusted package index. The package resolved by `pip` can therefore change after the skill has been audited. This is an insecure supply-chain practice even though the audit found no evidence that the named packages are intentionally malicious. Future repository compromise, resolver behavior, index substitution, or incompatible dependency updates could introduce code that executes during installation or import. ### Attack Path 1. The onboarding script runs in an environment lacking `requests`, `qrcode`, or `pillow`. 2. The script tells the user to install packages directly by name. 3. The user runs the unpinned `pip install` command. 4. `pip` resolves whatever versions and transitive dependencies are currently available from its configured index. 5. A compromised, substituted, or unexpectedly changed artifact is installed. 6. Package installation hooks or later imports execute code with the user's privileges. ### Impact Assessment A compromised dependency can execute arbitrary code with the privileges of the user running `pip` or the onboarding script. This may expose API ke ...[truncated 248 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (26)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The POST target is built from environment-controlled base URLs and then used to send sensitive login material, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or tokens; the skill context increases severity because this file explicitly handles authentication and key issuance.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is also derived from environment variables and used by urllib to contact the service while attaching the Authorization header from LINKFOX_AGENT_API_KEY. A compromised runtime or wrapper can point the gateway to an attacker host and cause direct API key leakage and unauthorized actions such as package lookup, order creation, or order-status polling.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination is influenced by environment-controlled configuration via LINKFOX_TOOL_GATEWAY, and the same request carries the Authorization API key plus session metadata headers. If an attacker can influence the runtime environment, they can redirect traffic to an arbitrary host and exfiltrate credentials and contextual identifiers, which is a real SSRF/credential-leak risk rather than a harmless configuration detail.

Content

Scanner excerpt · scripts/sellersprite_market_research.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is market research, but the referenced behavior includes authentication, API key generation, account/team info access, subscription listing, order creation, payment handling, QR-code payment generation, and payment-status queries. This is a major scope expansion into identity, billing, and account operations, creating opportunities for unauthorized transactions, sensitive data exposure, and user deception because the extra behaviors are not transparently declared.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

}

text

## Display Rules

1. 先给出市场候选 Top N，再展示核心指标（市场规模、集中度、新品占比）。
2. **入参回显**：`GoodsCrn` / `BrandCrn` / `SellerCrn` / `EbcProportion` / `FbaProportion` / `FbmProportion` / `AmazonSelfProportion` 对应筛选为 **0～1 小数**；向用户说明时可换算为百分数（如传 `0.4` 可表述为「商品集中度上限 40%」）。响应 `data[]` 里若仍带「(%)」字段，与入参刻度可能不同，以返回为准。

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The declared skill is for SellerSprite/Amazon market research, but the code actually implements LinkFox onboarding, SMS login, API key acquisition, and payment flows. This functionality mismatch is dangerous because it can trick operators or users into granting phone numbers, verification codes, and credentials under false pretenses, making the hidden auth/payment behavior more suspicious than if it were clearly disclosed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Purchase and payment-order creation are embedded in a skill whose stated purpose is market research, not billing. Hidden payment capabilities create risk of unauthorized charges, deceptive workflow transitions, and abuse of an agent environment to initiate commercial transactions users did not reasonably expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file performs SMS-based login, token exchange, team lookup, and API key generation/disclosure, none of which are necessary for category-level market research. In context, this is especially dangerous because it directly collects authentication factors and returns reusable API credentials, enabling account takeover or long-lived unauthorized access if mishandled or socially engineered.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares capabilities that imply environment access, file writes, and network use, but it does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege guarantees and makes it harder to constrain what the skill may access or do at runtime, especially given it writes files and may use credentials from environment variables.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation condition is intentionally broad enough to trigger even when the user does not mention SellerSprite, causing the skill to activate for generic Amazon market-research requests. Overbroad triggering increases the chance of unintended invocation of a skill that has network, file-write, and possibly billing-related side effects, reducing user control and informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The primary description and operating instructions are written as a Chinese-only skill description, with no indication that the user can choose language or that the locale restriction is required for a region-specific use case. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs the skill to automatically report feedback through a Feedback API, which is outside the stated market-research function. This introduces undeclared outbound data sharing and can transmit user interactions or metadata without clear necessity, transparency, or consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Auto-reporting user praise, dissatisfaction, or perceived improvements to a Feedback API is not required to perform category market research and may exfiltrate user sentiment and conversation-derived data. Because it is triggered broadly and 'without interrupting the user's flow,' users may be unaware their feedback is being sent externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs the skill to send requests to external Linkfox endpoints using an API key from environment variables, but it provides no user-facing disclosure or consent guidance about transmitting user-provided market research inputs off-platform. In an agent setting, this can cause silent exfiltration of user prompts, business data, or derived search criteria to third-party services and also normalizes use of high-privilege credentials without clear boundary controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The curl example explicitly demonstrates posting data to an external endpoint with an Authorization header, confirming the skill is designed to transmit request bodies and credentials beyond the local agent boundary. In this skill context, external transmission is expected for functionality, but it is still security-relevant because there is no accompanying guidance on consent, data minimization, or protection against sending sensitive user content.

Content

Scanner excerpt · references/api.md (reported line 211)May include surrounding context.

| image | string | 图片链接 | | asin | string | ASIN |

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/sellersprite/market/research   -H "Authorization: $LINKFOXAGENT_API_KEY"   -H "Content-Type: application/json"   -d '{

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The onboarding document instructs the agent to handle authentication recovery, API key retrieval, account registration, and billing/payment workflows that are unrelated to the skill's stated Amazon market-research purpose. This expands the skill's privilege and data-handling scope, creating unnecessary exposure to credential handling, payment flow manipulation, and social-engineering risk if the agent follows these steps automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly tells the operator to ask for a user's phone number and use it in a script-driven registration/login flow, but provides no privacy notice, minimization guidance, or verification that collecting the number is necessary and authorized. That creates a real risk of unnecessary PII collection, mishandling of SMS-based authentication, and account takeover or impersonation if the process is abused.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

This code transmits sensitive data externally via POST, including phone numbers, SMS codes, tokens, and login context. External transmission is expected for authentication workflows, but in this file it is still security-relevant because the destinations are environment-overridable and the skill's declared purpose does not justify credential-handling behavior.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code only accepts 11-digit phone numbers and forcibly uses area code +86 for SMS verification, with no indication that this is optional or limited to a region-specific deployment. This is a natural-language and behavior-level locale policy issue because the skill constrains users to a specific locale without offering choice or documenting a justified regional scope in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code generates or fetches an API token and emits it in stdout JSON without any in-file warning, masking, or guidance about secure handling. In agent and CLI environments, stdout is commonly logged, captured, or surfaced to orchestrators, so this can unintentionally disclose a reusable secret.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level documentation states that the full response is always written to <cwd>/linkfox/... and explicitly says writing to /tmp is forbidden. However, _linkfox_root() later implements fallback locations including ~/linkfox and $TMPDIR/linkfox, and _resolve_output_path() uses that resolver, so the actual persistence behavior contradicts the stated output policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME to the remote API without any visible minimization or user-facing disclosure in this code path. In this skill context, those identifiers may reveal conversation/session linkage and application context to an external service, increasing privacy and correlation risk, especially when combined with the gateway override behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Feedback API section defines an external POST endpoint for arbitrary feedback content but omits any warning that the submitted text leaves the local system and is sent to a third party. This creates a privacy and data-handling risk because users or agents may include sensitive operational details, prompts, or business information in feedback without realizing it is externally transmitted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The module docstring and command help text are presented entirely in Chinese, and the file offers no alternative language or opt-in mechanism. For a general-purpose skill, this can violate language/locale policy when a specific language is imposed without user choice or an explicit regional justification.

Content

No source excerpt is available for this finding.