卖家精灵-商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.6

Overview

The skill is a real Amazon product-search integration, but it also includes account login, API-key generation, billing, persistent credential setup, and automatic feedback reporting that users should review carefully before installing.

Install only if you are comfortable giving this skill access to a LinkFox API key, using a paid credit-based service, and potentially going through phone/SMS account onboarding. Review any payment plan and QR code before paying, avoid entering verification codes on shared machines, and prefer secure secret storage over writing API keys into shell profiles.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target is derived from environment-controlled base URLs and the request may carry login tokens, refresh tokens, phone numbers, or generated API tokens. If an attacker can influence the environment, the script can be redirected to a malicious endpoint, causing credential exfiltration and unauthorized account actions. In this skill, that risk is amplified because the file implements onboarding and token issuance rather than core Amazon product-search behavior.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request URL is built from environment-controlled configuration and includes the Authorization header populated from LINKFOX_AGENT_API_KEY. An attacker who controls the environment can redirect these requests to a server they control and harvest the API key or trigger unintended order/account operations. The mismatch between this capability and the skill's declared product-research purpose makes the behavior more suspicious and dangerous.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes and enables use of environment variables, network access, and filesystem writes, but does not declare these capabilities or constrain them with least-privilege boundaries. Hidden or undeclared capabilities reduce reviewability and make it easier for a seemingly simple product-search skill to access secrets, persist data locally, or transmit data off-box without clear operator awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a product-search tool, but the referenced behavior extends into authentication, account management, API key generation, subscription lookup, order creation, payment QR generation, and payment-status polling. This is a major scope expansion into sensitive account and financial operations, increasing the chance of credential handling, unauthorized transactions, or confusing the user about what the skill will actually do.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to automatically send user feedback to an external Feedback API even though that is outside the core product-search purpose. This creates an undisclosed secondary data flow that may transmit user content or behavioral signals to another service without explicit consent or clear minimization.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documentation adds a separate feedback-posting API that is unrelated to the core Amazon product-search function, expanding the skill’s effective capability surface. In an agent setting, this can enable unintended outbound data transmission of user content or conversation summaries to a third-party endpoint without a clear need tied to the user’s requested task, creating privacy and abuse risks.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The onboarding document adds account authentication, phone-based registration, API key acquisition, and billing/payment workflows that are not intrinsic to an Amazon product-search skill. This expands the skill's operational scope into credential handling and monetization flows, increasing phishing, data-handling, and abuse risk if the surrounding controls are weak or unclear.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The document instructs operators to facilitate account creation, login, plan listing, order creation, and payment support, which are capabilities beyond the stated product-research purpose. That mismatch is dangerous because users may be socially engineered into sharing phone numbers, verification codes, or making purchases under the guise of a research tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file provides account onboarding, SMS login, API-key acquisition, plan purchase, and payment QR generation, which are materially unrelated to the advertised Amazon product search/filtering skill. Such scope expansion increases the attack surface and creates paths for credential handling and billing actions that users would not reasonably expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and generate payment QR codes, enabling real billing actions inside a skill whose stated purpose is market/product research. This unjustified financial capability raises the risk of unauthorized charges, phishing-like payment prompts, or abuse if the skill is triggered unexpectedly or modified downstream.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The onboarding flow sends SMS codes, logs users in, calls account APIs, and returns an API key in a general-purpose CLI. These are powerful account-management capabilities beyond the declared product-search function and create clear opportunities for credential exposure, token misuse, and privilege expansion.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring explicitly states that writing to `/tmp` is forbidden and that a non-writable current directory should cause an error, but `_linkfox_root()` silently falls back to the home directory and then the temp directory. This mismatch can cause sensitive API responses and session metadata to be written to locations with weaker isolation or retention guarantees than operators expect, increasing the risk of unintended disclosure.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The activation text is broad enough to trigger on generic product-research or market-analysis requests, even when the user did not ask for this specific provider or tool. Overbroad triggering can cause unnecessary third-party API calls, unintended cost incurrence, and disclosure of user queries to an external service beyond what the user expected.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions tell an operator to collect a user's phone number, run login/registration commands, and then modify persistent shell configuration to install an API key, but they do not disclose privacy implications, secret-handling requirements, or system modification risks. This can lead to unauthorized collection of personal data, exposure of verification flows, and insecure persistence of credentials on the host.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The login flow emits the newly obtained API key directly to stdout JSON, which can be captured by logs, transcripts, shell history tooling, calling agents, or other integrations. Because API keys are bearer credentials, accidental exposure can lead to unauthorized API access and downstream account abuse.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.