Security audit

SIF-ASIN关键词

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an ASIN keyword lookup service, but it also handles credentials, payments, broad local storage, and automatic feedback reporting in ways users should review before installing.

Install only if you trust LinkFox with ASIN research data, account details, phone-based onboarding, and paid-credit workflows. Before use, avoid endpoint override environment variables, review where files are written, prefer a safer secret store over shell-profile API keys, and require explicit confirmation before feedback submission, API-key generation, or any payment/order action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:240
Finding: Automatic Transmission of Conversation-Derived Feedback Without Explicit Consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sif_asin_keywords.py:36
Finding: Environment-Controlled API Endpoints Permit Credential and Personal-Data Exfiltration
Content: View full analysis
str: """Gateway base address: env LINKFOX_TOOL_GATEWAY takes priority.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert( 0, os.path.join( os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared", ), ) return get_api_base() + API_PATH def get_api_key(): key = ( os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") ) if not key: print("API Key is not configured", file=sys.stderr) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script uses the same pattern for additional sensitive endpoints: ```python def _login_base() -> str: return _env_base( "LINKFOX_LOGIN_API_URL", "https://api.linkfox.com", ) def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-ap ...[truncated 2655 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sif_asin_keywords.py:249
Finding: Unsanitized SESSION_ID Enables Filesystem Path Traversal
Content: View full analysis
str: """Prefer env SESSION_ID; otherwise generate HHMMSS-<6 hex>.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """Return (linkfox_root, session_dir); session_dir is created.""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script contains equivalent behavior: ```python sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name despite being supplied through the process environment. It is not checked for: - `..` path components - Forward or backward path separators - Absolute paths - Drive letters on Windows - Null or control characters - Resolution outside the intended LinkFox root `os.path.join()` does not provide confinement. An absolute final component can replace the preceding path, while traversal components can escape the expected date and root directories. T ...[truncated 1389 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sif_asin_keywords.py:98
Finding: Plaintext Persistence and Output of Sensitive API Data and Credentials
Content: View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` The documentation recommends plaintext shell-profile persistence: ```text echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis Comple ...[truncated 1822 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/onboarding.py:164
Finding: Unpinned Runtime Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
dict: try: import qrcode except ImportError: err = ( "Missing qrcode dependency; " "please run: pip install qrcode pillow" ) print( f"{TAG} render_qr: {err}", file=sys.stderr, ) return { "png_path": None, "ascii_qr": None, "error": err, } def _require_requests() -> None: if requests is None: raise RuntimeError( "Missing requests dependency; " "please run: pip install requests" ) ``` ### Technical Analysis The onboarding workflow directs users to install mutable package names without: - Exact version pins - Cryptographic hashes - A reviewed lockfile - An authenticated and explicitly trusted package index - An isolated environment requirement Package installation can execute package build or installation logic. If a package, dependency, mirror, index configuration, or resolved future version is compromised, arbitrary code may execute under the user's account. The identified package names are not themselves evidence of malicious packages. The vulnerability is the unsafe, non-reproducible installation process. ### Attack Path 1. The onboarding environment lacks `requests`, `qrcode`, or `pillow`. 2. The script instructs the user to run the displayed `pip install` command. 3. Pip resolves the package and transitive dependencies from the configured index or mirror. 4. A compromised index, malicious mirror, dependency takeover, or compromised future release supplies hostile installation content. 5. Package installation or subsequent import executes attacker-controlled code with the user's privileges. ### Impact Asses ...[truncated 420 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sif_asin_keywords.py:200
Finding: Implementation Writes Sensitive Responses to Temporary Storage Contrary to the Declared Policy
Content: View full analysis
str: """Choose a writable LinkFox root. Priority: 1. linkfox/ below the first ACPX_WORKSPACES path 2. linkfox/ below the current working directory 3. ~/linkfox/ 4. $TMPDIR/linkfox/ """ cached = _SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append( os.path.join(os.path.expanduser("~"), "linkfox") ) import tempfile candidates.append( os.path.join(tempfile.gettempdir(), "linkfox") ) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _SESSION_CACHE["_root"] = root return root ``` The declared behavior states that temporary storage is prohibited and that the script will fail if the current directory is not writable: ```markdown Always write the complete response below `/linkfox/...`; writing to `/tmp` is prohibited, and report an error when the current directory is not writable. ``` ### Technical Analysis The code and documentation establish conflicting se ...[truncated 1598 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (20)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, authorization headers, and generated API tokens to those endpoints. If an attacker can influence environment variables in the host runtime, they can redirect authentication and credential traffic to attacker-controlled servers, causing credential exfiltration and account compromise.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The gateway request path uses environment-derived base URLs with an Authorization header carrying the API key, then transmits via urlopen. A hostile environment configuration can silently redirect billing, account, and package/order requests to an attacker endpoint and leak the API key and related account metadata.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/sif_asin_keywords.py (reported line 79)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as an ASIN keyword lookup tool, but it also performs undeclared local persistence and caching of full API responses, with behavior inconsistent with the documentation about write locations. Storing full responses and session metadata on disk, especially with fallback paths like the home directory or temp locations, can expose sensitive data, weaken user control, and make forensic review harder.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as an ASIN keyword lookup tool, but it also performs undeclared local persistence and caching of full API responses, with behavior inconsistent with the documentation about write locations. Storing full responses and session metadata on disk, especially with fallback paths like the home directory or temp locations, can expose sensitive data, weaken user control, and make forensic review harder.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger conditions are broad enough to activate on generic ASIN/keyword requests even when the user did not intend to use this specific paid, data-accessing skill. In context, this is more dangerous because the skill incurs cost and performs networked data retrieval and storage, so over-triggering can lead to unnecessary charges and excessive data handling.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
asin: "B0XXXXXXXX", country: "US", conditions: "isSearchVolUpKw", sortBy: "estSearchesNum", desc: true

text
## Display Rules 1. **Present data only**: Show query results in clear tables without subjective business advice. 2. **Ranking clarification**: When showing ranking data, remind users that lower numeric values mean better (higher) positions.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`） - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This skill is described as ASIN keyword analytics, but the file implements account onboarding, SMS login, API key acquisition, subscription discovery, ordering, and payment QR generation. That is a strong scope mismatch: the skill gains access to credentials and purchase workflows unrelated to the claimed user task, increasing the chance of unauthorized account actions and sensitive data collection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script can create orders, choose payment methods, retrieve payment URLs/QR codes, and query order states despite the skill being marketed as analytics functionality. Embedding commerce capabilities in an unrelated skill broadens the attack surface and could enable unauthorized purchases or social-engineering flows that pressure users into payment under false pretenses.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code logs in with SMS, fetches team/user information, and retrieves or generates API credentials for the user or group. Generating long-lived API keys inside a skill exceeds the stated analytics purpose and creates a high-value secret that, if intercepted, logged, or abused, can grant ongoing access beyond a single session.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no explicit tool scope while the content and referenced behavior require environment access, filesystem writes, and network calls. Without a least-privilege allowlist, an agent may grant broader capabilities than users expect, increasing the chance of unintended data access, persistence, or external transmission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The activation and operational description includes mandatory Chinese-language phrasing and does not indicate that users may choose their preferred language or locale for interaction. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 97)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/sif/asinKeywords \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file documents a separate feedback endpoint that is unrelated to the stated ASIN keyword lookup capability. In an agent-skill context, unrelated network actions expand the skill's effective scope and create a channel for exfiltrating user content, operational details, or hidden telemetry to a second external service the user did not request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions explicitly tell the operator to collect a user's phone number and submit it to a registration/login script, but they do not require any notice, consent language, retention limits, or guidance on handling the resulting personal data. In an onboarding context this creates a real privacy and compliance risk because an agent may solicit and transmit sensitive user information without informing the user how it will be used or protected.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring promises that outputs are always written under the current working directory and explicitly forbids /tmp, but the actual implementation falls back to ~/linkfox and then the system temporary directory. In an agent setting, operators or downstream components may rely on the documented storage restriction for data governance, so this discrepancy can cause sensitive API results to be persisted in unintended locations with weaker isolation or retention controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents the main API reference content in Chinese, which effectively forces a specific language for users reading the skill documentation. The policy allows fixed-language behavior only when users are given a language choice or when the locale constraint is clearly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The comment says responses at or below the threshold are 'directly output, not written to file', but main() unconditionally serializes the result and writes it to out_path before deciding whether to print inline or summarize. This is an active contradiction between code documentation and execution behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.