SIF-ASIN流量概览

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:33 AM UTC
• Version: 1.0.8

Overview

The skill’s ASIN analysis function is mostly coherent, but it adds high-impact account, billing, credential, automatic feedback, and persistence behaviors that need review before installation.

Install only if you are comfortable with a LinkFox skill that can use your LinkFox API key, store full result data locally, help create paid orders when credits are insufficient, and collect phone/SMS information for account setup. Avoid running onboarding or payment commands unless you intentionally requested them, and treat any printed API key as a secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, access tokens, and generated API keys, to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to attacker-controlled infrastructure and capture credentials or payment-related data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request path uses environment-derived base URLs and attaches the API key in the Authorization header before calling urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related variables can exfiltrate the API key and manipulate package, order, or account requests by redirecting traffic to a malicious endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill uses sensitive capabilities (`env`, `file_write`, `network`) without declaring them, which weakens reviewability and consent around what the skill can access and do. In this context the omission matters because the skill also handles API authentication and persists fetched data locally, so hidden capabilities can surprise operators and expand the attack surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a serious description-behavior mismatch: a skill presented as ASIN traffic analysis appears to include account login, API key management, billing, order creation, and payment-status flows unrelated to the stated purpose. That broadens the reachable functionality into authentication and financial operations, increasing the chance of credential misuse, unauthorized purchases, or deceptive invocation under a benign analytics label.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documentation embeds a separate feedback-submission API that is unrelated to the ASIN analysis function, creating an unexpected secondary outbound action path. In an agent setting, this can prompt the runtime to send user content or execution summaries to another service without a clear user request, increasing the risk of unauthorized data exfiltration or scope creep.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS authentication, API key acquisition, and commerce flows, none of which are necessary for an ASIN traffic-source analysis skill. The mismatch between declared skill purpose and actual behavior greatly increases suspicion because it expands access to user credentials and billing operations under the guise of analytics.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The billing code can list paid plans, create orders, and render payment QR codes, which is unrelated to the advertised analytics capability. In this context, hidden purchase functionality is dangerous because it can drive unauthorized or deceptive transactions from a skill that users would not expect to initiate billing.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code performs SMS-based login, fetches user/team data, and generates or retrieves API tokens, all outside the scope of ASIN traffic analysis. In a mis-scoped skill, credential handling is especially dangerous because it can be used to harvest account access under a misleading description.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module documentation says output is always written under the current working directory and explicitly forbids /tmp, but the implementation can fall back to ~/linkfox or the system temp directory. This mismatch can cause sensitive API responses to be stored in less expected or less protected locations, undermining operator assumptions about data residency and cleanup.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger definition is overly broad and explicitly activates even when the user does not mention SIF, causing the skill to capture generic ASIN-analysis requests. In combination with its external API usage and cost-incurring behavior, over-triggering can lead to unintended data disclosure, unnecessary charges, and routing users into functionality they did not knowingly request.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs that full API responses must always be written to the project directory, with no prominent user-facing warning or opt-in for local persistence. Because those responses may include business-sensitive product intelligence, account-related metadata, or other externally retrieved data, mandatory disk writes increase exposure through later workspace access, accidental commits, or cross-task leakage.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The API instructions tell the agent to read an Authorization key from environment variables and send it to an external endpoint, but provide no user-facing warning or control around credential use or outbound transmission. In an agent environment, that can normalize silent secret use and make it easier for adjacent instructions or future modifications to trigger authenticated requests without adequate transparency.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs collecting a user's phone number and sending it through a scripted registration flow, but it does not disclose what personal data is transmitted, how it is used, or obtain explicit user consent. In an agent context, this can lead to unnecessary collection and handling of sensitive personal data without adequate privacy safeguards.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The login command prints the acquired API key in stdout JSON, making it easy for the secret to be exposed through logs, transcripts, shell history capture, or downstream tooling. Because the key grants API access, accidental disclosure can lead to account misuse or unauthorized actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: This is an external transmission sink used to send login and token-related data over the network. In combination with environment-controlled endpoints and the skill's unexpected credential-handling role, it creates a credible path for exfiltration of sensitive user and account data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.