SIF-ASIN关键词

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:33 AM UTC
• Version: 1.0.8

Overview

The skill mostly supports a paid ASIN keyword lookup service, but it also includes sensitive account setup, payment, feedback reporting, and credential-handling paths that deserve manual review before installation.

Install only if you are comfortable with LinkFox receiving ASIN query data and with the skill helping manage LinkFox account setup and payments. Prefer using LinkFox's self-service site for login, API-key retrieval, and billing; avoid sharing SMS codes in chat; review generated payment orders before paying; and be aware that full API responses may be saved locally under linkfox directories.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API tokens to those endpoints. If an attacker can influence environment variables, this becomes server-side exfiltration of credentials and account data to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway URL is derived from environment variables and used in outbound urllib requests with the Authorization header containing the API key. An attacker who can set the base URL can redirect these authenticated requests and harvest the API key or manipulate billing and account operations.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 94% confidence
• Finding: The request sent to the network includes multiple environment-derived values in headers, including an API key and session metadata, and the destination host is overridable through LINKFOX_TOOL_GATEWAY. This creates a real exfiltration risk: if an attacker can influence the environment, the script will send credentials and contextual identifiers to an arbitrary endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require reading environment variables, writing files to the working directory, and making network/API requests. This mismatch prevents informed consent and weakens sandbox/policy enforcement because the runtime capabilities used by the skill are broader than what is disclosed.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as ASIN keyword analysis, but static analysis indicates it also supports account login, API-key acquisition, account inspection, plan purchasing, payment QR generation, and order-status queries. Hidden authentication and payment workflows materially expand the trust boundary and could lead to credential handling or unauthorized commercial actions under the guise of analytics.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill instructs automatic feedback reporting via an external API even though that behavior is unrelated to the user’s ASIN keyword lookup request. This creates an undisclosed side channel that may transmit user content, metadata, or behavioral signals without clear necessity or consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation embeds a separate feedback-reporting API that is unrelated to the stated ASIN keyword lookup function, creating scope expansion inside the skill. In an agent setting, this can prompt a model or integrator to send user content, operational details, or outcomes to an external endpoint without a clear user request or least-privilege boundary, enabling unintended data exfiltration or covert telemetry.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file adds authentication recovery, registration, and billing purchase workflows to a skill whose stated purpose is ASIN keyword analytics. This expands the skill into account and payment handling, increasing attack surface and creating opportunities for credential/token mishandling, phishing-like user flows, and unauthorized collection of sensitive data unrelated to the core function.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Embedding account onboarding and payment capabilities inside an analytics skill is a scope violation that can mislead operators into performing sensitive account actions under the guise of keyword lookup. In context, this is more dangerous because the skill is expected to analyze ASIN keywords, not collect credentials, register accounts, or facilitate purchases, so users and operators may not apply appropriate scrutiny.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements onboarding, authentication, API-key issuance, plan lookup, ordering, and payment QR generation, which is materially outside the declared ASIN keyword analysis function of the skill. Scope mismatch increases the chance that users are prompted for credentials and payments unrelated to the expected task, creating a phishing-like and overprivileged behavior pattern.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Billing and payment-order creation are not justified by the skill's stated purpose of keyword analysis and expose users to financial actions from within an unrelated workflow. In a skill ecosystem, hidden or unnecessary purchase functionality is particularly dangerous because it can be abused for unexpected charges or social engineering.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The SMS login flow collects phone numbers and verification codes and then generates or retrieves API tokens, which is far beyond the minimum behavior needed for keyword analysis. This concentrates identity verification and secret issuance in a skill that users would not expect to function as an account bootstrapper, increasing credential theft and account-takeover risk.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The docstring promises the tool will not write to /tmp and will fail if the current directory is not writable, but the implementation silently falls back to home and temporary directories. In a security-sensitive agent context, this mismatch can cause data to be persisted in less controlled locations than operators expect, increasing the chance of unintended disclosure of API responses and session artifacts.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger scope is intentionally broad enough to activate for nearly any ASIN-related keyword request, even when the user did not request SIF or this specific tool. Over-broad activation increases the chance of unnecessary external API calls, data disclosure, and paid operations being performed in contexts where the user did not intend to use this skill.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions tell operators to collect a user's phone number and verification code and process login steps, but provide no privacy warning, retention limits, masking requirements, or token-handling safeguards. This creates risk of exposing personal data and authentication secrets, especially because the workflow also returns an API key that may be copied into user-visible channels.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script returns the newly obtained API key in stdout JSON, which may be captured by logs, chat transcripts, orchestration layers, or other plugins. Exposing long-lived credentials through normal output channels materially increases the chance of credential leakage and downstream account compromise.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 89% confidence
• Finding: The code performs external transmission via requests.post in paths that carry sensitive authentication material. External transmission is expected in networked tools, but here it becomes security-relevant because the destinations are partially configurable and the payload includes secrets and personal data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.