Shopify店铺查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.9

Overview

This Shopify query skill should go to Review because it also handles phone/SMS login, API keys, billing orders, configurable secret-bearing network calls, and persistent local result storage beyond a simple lookup tool.

Install only if you are comfortable using LinkFox as a paid external service from this agent. Confirm before sending phone numbers, SMS codes, API keys, or proprietary store-research criteria; avoid setting LinkFox endpoint override environment variables unless you fully trust the destination; and review or clean the local linkfox output/cache directories because full responses may be retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, so anyone who can influence the runtime environment can redirect login and token requests to an attacker-controlled endpoint. Because these requests carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this creates a clear credential exfiltration and SSRF-style risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL used by urlopen is built from environment-derived base URLs and then called with the API key in the Authorization header. If an attacker can set LINKFOX_AGENT_API_URL or related variables, they can redirect requests and capture the API key or force the tool to interact with unintended internal or external services.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 97% confidence
• Finding: The request sent via urlopen includes environment-derived values in headers, including an API key and session/app metadata, and the destination base URL is itself overrideable via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration risk: a compromised or attacker-controlled environment can redirect authenticated requests and attached metadata to an arbitrary host, leaking credentials and user query data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions, but its documented behavior and referenced scripts indicate access to environment variables, file-related capabilities, and outbound network calls. This creates a transparency and consent problem: the runtime may grant or exercise capabilities the user and platform policy do not expect, increasing the chance of unauthorized data access or side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a Shopify store query tool, but the referenced onboarding and billing flows extend into authentication, account inspection, subscription listing, order creation, payment QR rendering, and payment status checks. That mismatch materially broadens the trust boundary: invoking a data-query skill could trigger account or payment-related actions the user did not intend, enabling surprise charges, credential handling, and privacy exposure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS login, API key acquisition, package listing, ordering, and payment flows, which are unrelated to a Shopify store query skill. Such scope expansion increases the attack surface and enables collection of user credentials and monetization actions far beyond the declared purpose of the skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes despite the skill being described as a Shopify store search tool. Billing capabilities in an unrelated skill are dangerous because they can trigger purchases, facilitate social engineering, and expose users to unauthorized charges.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script performs SMS-based authentication and returns API keys, which is not justified by the stated Shopify store-query functionality. In this context, collecting phone numbers and verification codes materially raises the risk of credential theft, account takeover, and misuse of generated tokens.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill is described as a store-query tool, but it also persistently writes full API responses, cache entries, and session metadata to disk. That broader data-retention behavior increases exposure of potentially sensitive business queries, results, and identifiers beyond what a user would reasonably expect from a simple lookup skill.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The docstring promises that writing to /tmp is forbidden and that non-writable current directories will cause an error, but the implementation silently falls back to home and temporary directories. This mismatch is dangerous because it defeats operator expectations about where potentially sensitive output will be stored, leading to unintended persistence in less controlled locations.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger text is extremely broad, including generic Shopify-store discovery and analysis requests even when the tool name is not mentioned. Overbroad invocation increases the chance the agent will call this skill in contexts where the user did not intend external queries, billing-incurring operations, or exposure of search criteria to third-party services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The onboarding guide explicitly instructs collecting a user's phone number and using it to register or log in via a script, but it provides no privacy notice, consent language, retention limits, or guidance on safe handling of personal data. In an agent context, this creates a real privacy and compliance risk because operators may solicit and process sensitive personal information without transparency or minimization.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The login flow returns a live API key in stdout JSON without any built-in warning, masking, or secure handoff mechanism. In agent environments, stdout is often logged, persisted, or shown to other components, so exposing secrets this way can lead to credential leakage and downstream abuse.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script transmits user-supplied query parameters together with session/app metadata to a remote service, but it provides no runtime transparency or consent mechanism around that disclosure. In this skill context, store research queries may contain proprietary lead-generation criteria or operational context, so silent transmission increases privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script caches and persists full API results locally, and its path-selection logic can place those files outside the active project directory, including home or temp locations. This expands the chance of sensitive query results being retained longer than intended, discovered by other processes/users, or missed by normal cleanup workflows.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This code transmits sensitive authentication and account data to external services via requests.post. External transmission is especially risky here because the same component handles SMS login, tokens, and API key generation, so any misuse of destination control or logging can expose high-value secrets.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.