卖家精灵-商品搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:49 AM UTC
• Version: 1.0.7

Overview

The skill provides Amazon product search, but it also handles account credentials, payments, persistent local storage, endpoint overrides, and automatic feedback reporting that users should review before installing.

Install only if you are comfortable sending Amazon product-research queries and optional session metadata to LinkFox, storing full API responses locally, and using LinkFox account/payment flows from this skill. Treat any generated API key as sensitive, avoid shell-history or transcript exposure, and review endpoint environment variables before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:293

Finding

Silent Transmission of User Feedback and Inferred Intent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sellersprite_product_search.py:36

Finding

Credential Exfiltration Through Unvalidated API Endpoint Overrides

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding similarly allows all sensitive service origins to be overridden: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Authorization tokens are then attached without destination validation: ```python if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID ``` ### Technical Analysis Environment variables can replace trusted LinkFox origins with arbitrary URLs. The ...[truncated 1946 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:475

Finding

API Keys and Login Secrets Exposed Through Command Arguments and Standard Output

Content

View full analysis

python scripts/onboarding.py login ``` The CLI accepts both values as positional arguments: ```python p = sub.add_parser("login") p.add_argument("phone") p.add_argument("code") p.add_argument("--channel", default="skill") ``` A complete API key is returned in the result: ```python return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The result is emitted directly to standard output: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` The documentation then recommends writing the key in plaintext into shell startup configuration. ### Technical Analysis Command-line arguments commonly appear in shell history and may be visible through process-inspection facilities while the command is running. Passing an SMS code and phone number as positional arguments therefore exposes authentication material beyond the process that needs it. The API key is printed as plaintext JSON. In Agent-hosted, CI, terminal-capture, or debugging environments, stdout may be retained in logs or conversation transcripts. Forwarding the key through an Agent response further expands the disclosure surface. Writing a key into `.bashrc` or `.zshrc` also stores it as long-lived plaintext, potentially readable by backup software, extensions, diagnostic tools, or other processes running under the ...[truncated 965 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:171

Finding

Unpinned Runtime Dependencies Create a Supply-Chain Risk

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` The project contains no dependency lockfile, pinned version constraints, or package hashes for `requests`, `qrcode`, or `pillow`. ### Technical Analysis The instruction to run: ```text pip install qrcode pillow ``` allows pip to resolve the latest versions and their transitive dependencies at installation time. Without exact versions and cryptographic hashes, installation is not reproducible and the effective dependency set can change after this Skill has been audited. This does not prove that the named packages are malicious. The vulnerability is the absence of supply-chain controls around runtime installation of code that will execute in the same process as account, payment, and token-handling logic. ### Attack Path 1. The user invokes a feature requiring a missing dependency. 2. The script recommends installing unconstrained packages from the configured Python package index. 3. pip resolves versions and transitive dependencies available at that time. 4. A compromised package release, dependency, mirror, or index supplies malicious installation or runtime code. 5. The package executes with the privileges of the user running onboarding. 6. It can access process memory, environment variables, API keys, tokens, payment URLs, and local files available to that user. ### Im ...[truncated 535 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sellersprite_product_search.py:202

Finding

Undocumented Shared Temporary-Directory Fallback and Insecure Artifact Storage

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (29)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence the runtime environment, this becomes SSRF plus credential exfiltration to attacker-controlled infrastructure, which is especially dangerous because this file handles authentication and token issuance flows.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses an environment-derived base URL and attaches the API key in the Authorization header before calling urlopen. A maliciously set environment variable could redirect requests to an attacker server and leak bearer credentials, or pivot requests to unintended internal services.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/sellersprite_product_search.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is Amazon product filtering, but the skill also introduces account login, API-key generation, user/team info retrieval, plan listing, order creation, payment initiation, QR generation, and payment-status checks. That is a major scope expansion into identity and billing workflows, which can expose users to unexpected credential handling and financial actions unrelated to the stated function.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger criteria are intentionally broad and direct activation even when the user does not explicitly mention the product-search tool, covering many generic market-research requests. Overbroad triggering can route user requests into a paid, data-exfiltrating, or side-effecting workflow without sufficiently clear user intent or informed consent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

}

text

## Display Rules

1. **Present data clearly**: Show query results in well-structured tables. Key columns to prioritize: ASIN, title, price, monthly sales, monthly revenue, BSR rank, rating, ratings count, gross margin, fulfillment type
2. **BSR clarification**: When showing BSR data, remind users that lower values mean better rankings

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This onboarding CLI performs account login, token retrieval, subscription plan enumeration, order creation, and payment QR generation, which materially exceeds the declared Amazon product-search/selection purpose of the skill. Capability mismatch is dangerous because users and reviewers may grant trust or permissions expecting research functionality, while the code actually handles credentials and commerce operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file can create paid orders and render payment QR codes, an unjustified commerce capability for a product-research skill. In context, this increases risk of deceptive billing, unauthorized purchase flows, and user confusion because monetization actions are embedded in a skill that should only search and analyze Amazon products.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring explicitly says writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and temp directory. This mismatch defeats operator expectations and may cause sensitive API responses to be stored in less secure or more broadly accessible locations, especially /tmp on multi-user or ephemeral systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises only product search guidance, but its instructions clearly rely on environment variables, network access, and mandatory file writes without declaring any explicit tool scope or least-privilege boundary. This makes it harder for a host or reviewer to understand what capabilities the skill needs and increases the chance of overbroad execution in environments with sensitive credentials or writable project files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The parameter description instructs translating the user's keyword to the target marketplace language, which imposes a language/locale transformation by default. Because the file does not present this as a user choice or opt-in, it can violate language preference expectations for multilingual users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates persistent local storage of full API responses in session-scoped project files, which exceeds a simple search/display role and can retain sensitive query inputs, session identifiers, and commercial data longer than necessary. Persistent storage in the working directory also increases exposure to other tools, collaborators, or later prompts that can read those files.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Persistently logging full tool responses into predictable session-scoped files can expose user-provided inputs, API-derived business data, and session-linked metadata to later prompts, local users, or other tools with filesystem access. Because the behavior is mandatory and defaults to the project directory, the surrounding skill context makes retention and accidental disclosure more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This instruction says to translate user-provided keywords to the target marketplace language whenever the languages differ, and only note the translation afterward. That is a natural-language policy concern because it mandates a locale/language change without first obtaining user opt-in or offering alternatives.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs automatic feedback API reporting on broad conditions, including user praise/dissatisfaction, without tying that behavior to the core product-search function or making consent boundaries clear. This can cause unsolicited transmission of conversation-derived metadata or user sentiment to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs authenticated requests to an external gateway using environment-sourced API keys and allows transmission of identifiers like chatId, uid, requestId, and teamId, but gives no user-facing disclosure about that outbound data sharing. In an agent setting, this is a genuine privacy and data-governance issue because user queries and identifiers may be sent off-platform without informed consent or minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The curl example confirms external transmission of user-supplied search parameters and authenticated requests to a third-party gateway. In this skill context, external transmission is expected for functionality, but it remains a real security/privacy concern because the documentation does not constrain or warn about sending identifiers and potentially sensitive business research queries off-platform.

Content

Scanner excerpt · references/api.md (reported line 286)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/sellersprite/productSearch \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file documents a separate feedback API that is unrelated to the core Amazon product-search function, expanding the skill's data flows beyond what a user would reasonably expect from the tool description. Because the feedback payload explicitly asks for user statements and outcome details, this creates a real risk of sending conversational content to a second external service without clear user awareness or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The feedback endpoint specifically instructs submission of user statements, intended outcomes, and what actually happened to a separate external API, yet includes no privacy warning, consent flow, or redaction guidance. This is more dangerous than ordinary telemetry because it can directly exfiltrate potentially sensitive conversation content to a second system unrelated to the primary search request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and user-facing help/messages are entirely in Chinese, including command descriptions and operational guidance. There is no indication that users may select another language or that the locale restriction is intentional and documented as a region-specific requirement.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script retrieves or generates API tokens for the user's LinkFox account, which is broader and more sensitive than the advertised product-search function. In this context, token issuance can expand account access and create long-lived credentials that may later be misused outside the narrow task the user expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code returns a newly obtained API key directly in stdout JSON without any explicit warning about its sensitivity, storage implications, or handling requirements. In CLI and agent contexts, stdout is often logged, captured, or surfaced to other components, so this can expose reusable credentials unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill persists full responses to disk and caches them without any user-facing disclosure or consent mechanism, creating an unnecessary secrecy and privacy risk. Even if the API mostly returns product data, responses and metadata can still contain usage patterns, session identifiers, and other operational details that should not be silently retained.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.