SIF-ASIN流量概览

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:38 AM UTC
• Version: 1.0.8

Overview

This skill mostly matches its ASIN analysis purpose, but it also includes silent feedback reporting, credential-heavy onboarding, payment flows, and unsafe environment/file handling that users should review carefully before installing.

Install only if you are comfortable with LinkFox receiving ASIN query data and, through the feedback instruction, potentially conversation-derived feedback content. Use a dedicated API key with limited value, avoid pasting secrets into shell history or startup files, do not run billing/order commands unless you explicitly intend to pay, and avoid custom endpoint or SESSION_ID environment values unless you fully control them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:254

Finding

Automatic Transmission of User Statements and Intentions to a Third-Party Feedback Service

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:266

Finding

Persistent Promotional Instruction Alters Task-Focused Agent Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sif_asin_summary.py:249

Finding

Unsanitized SESSION_ID Allows Response Files to Escape the Intended Storage Directory

Content

View full analysis

str: """Prioritize env SESSION_ID; otherwise generate HHMMSS-<6 hex>.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """Return (linkfox_root, session_dir); session_dir always exists.""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The same unsafe pattern appears in `scripts/onboarding.py`: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is accepted directly from the environment and used as a filesystem path component. The code does not reject: - Absolute paths - `..` traversal components - Directory separators - Platform-specific drive or UNC paths - Symlink-mediated escapes With `os.path.join`, an absolute final component can discard preceding path components on applicable platforms. Relative traversal sequences can resolve outside the intended `/` direct ...[truncated 1704 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sif_asin_summary.py:36

Finding

Environment-Controlled Service Origins Can Redirect Credentials and Personal Data

Content

View full analysis

str: """Gateway base address: env LINKFOX_TOOL_GATEWAY takes precedence.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` From `scripts/onboarding.py`: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: """Generic requests POST.""" try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() ``` Sensitive login tokens are attached to the configurab ...[truncated 2691 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:486

Finding

Generated API Key Is Exposed in Standard Output and Plaintext Shell Configuration Workflows

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key", file=sys.stderr) return 0 return 1 ``` The onboarding documentation recommends interpolating the key into shell commands and persistent profile files: ```markdown - Windows PowerShell: `setx LINKFOX_AGENT_API_KEY ""` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` ``` ### Technical Analysis The generated API key is printed in full to standard output as part of a JSON document. In Agent-hosted or automated environments, stdout may be retained in transcripts, execution logs, telemetry, terminal scrollback, or captured command results. The documented configuration workflow also encourages users to place the key directly in a shell command. This can expose it through command history, process inspection during execution, screen recordings, support logs, or copied transcripts. Persisting the key in `.bashrc` or `.zshrc` stores it in plaintext and may expose it throu ...[truncated 1364 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The code builds outbound request destinations from environment-controlled base URLs and then sends authentication tokens, SMS-login data, and API-key-related payloads to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect sensitive traffic to attacker-controlled infrastructure, causing credential/API key exfiltration and SSRF-like abuse.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway request path uses an environment-derived base URL and then performs authenticated network calls with the API key in the Authorization header. An attacker who controls the environment can redirect these requests to a malicious server and capture the API key or trigger requests to unintended internal/external services.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/sif_asin_summary.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is ASIN traffic analysis, but the documented behavior extends into authentication, account access, plan discovery, payment-order creation, QR-code generation, and payment-status polling. This is a serious scope mismatch because a user invoking analytics could unknowingly trigger account or billing workflows, expanding the attack surface to personal, financial, and credential-related actions.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

searchValue: "B0A,B0B,...,B0J", conditions: "sp", sortBy: "totalSpSocre", desc: true

text

## Display Rules

1. **Present data clearly**: Show query results in well-structured tables; separate product metadata, current-period scores, keyword counts, and period-over-period comparison columns into logical groups for readability
2. **Percentage formatting**: When displaying exposure ratios, format them as percentages (e.g., 0.45 as 45.0%) for easier comprehension

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file's behavior is materially different from the declared skill purpose of ASIN traffic/source analysis: it performs account onboarding, SMS authentication, API key acquisition, plan listing, ordering, and payment QR generation. Such scope divergence is dangerous because it can trick users into disclosing phone numbers, verification codes, or enabling billing flows unrelated to the advertised analytics capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes order creation and payment QR generation even though its stated function is ASIN traffic analysis. In skill ecosystems, undisclosed payment capability raises the risk of deceptive monetization, unauthorized billing prompts, and social engineering under the guise of analytics assistance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements SMS-based authentication, token exchange, user/team enumeration, and API key retrieval, none of which are necessary for a traffic-analysis-only skill. This creates a phishing-like risk surface where users may be induced to provide phone numbers and one-time codes, enabling account compromise or unauthorized token generation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and documents capabilities to read environment variables, write files, and make network calls, but it declares no explicit tool scope or permission boundaries. This creates an over-privileged execution model where the agent may access secrets, persist sensitive data locally, or call unintended endpoints without clear user or platform constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation description is broad enough to trigger on many generic ASIN-analysis requests even when the user did not intend to use this specific paid external-data skill. That increases the chance of unintended tool invocation, unnecessary data disclosure to a third-party service, and surprise cost-incurring API calls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 135)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/sif/asinSummary \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents a separate feedback-posting API that is unrelated to the stated ASIN traffic analysis function of the skill. Adding an extra outbound-write capability expands the skill’s effective scope and can enable unauthorized or unexpected data transmission to a third-party endpoint, especially if an agent is induced to send user content or operational details there.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The onboarding instructions explicitly ask the user to provide a phone number so a local script can register on their behalf, but they do not disclose how that personal data will be transmitted, stored, or protected. In a skill context, this creates unnecessary privacy and trust risk because users may reveal sensitive contact information to an automation flow without informed consent or data-handling boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code validates only 11-digit phone numbers and sends login requests with a fixed areaCode of +86, which enforces a specific locale and excludes other regions. This is a natural-language/policy concern because the CLI behavior is locale-constrained without user opt-in or documented choice in the interface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

During login, the CLI again restricts input to 11-digit numbers and passes areaCode +86 to the backend, enforcing a single regional format. There is no visible option for other locales or an explicit user-facing statement here that the tool is intentionally limited to China-region accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The order flow renders and saves a payment QR code PNG to a filesystem path returned by session_dir(), which creates persistent directories under the workspace, home directory, or temp directory. While the code comments describe QR handling internally, there is no confirmation prompt or user-facing warning in this file that running the order command will create local files containing payment data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language interface and operational guidance are written exclusively in Chinese, including usage behavior and output policy, with no indication that the user can select another language. This creates a locale/language constraint in the skill’s user-facing behavior without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script documentation promises that output is written under the current working directory and explicitly forbids /tmp, but the implementation silently falls back to ~/linkfox and then the system temp directory. Because the response can contain traffic-analysis data and metadata, this mismatch can cause sensitive data to be stored in less controlled or shared locations, undermining operator expectations and data-handling guarantees.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file contains user-facing operational guidance in Chinese, including the main trigger description, invocation instructions, and cost warnings, without stating that the language is configurable or chosen based on user preference. This can violate language/locale policy if the organization expects skills not to force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Sections covering invocation method, cost constraints, output strategy, and authentication guidance are partly or entirely in Chinese, while the rest of the document is mixed-language. Without an explicit user language choice or documented region-specific scope, this imposes a language preference in natural-language instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The fee-related warning is an important user-facing instruction, but it is only expressed in Chinese. If users are not guaranteed to be Chinese-speaking, this creates a language-policy issue because a critical disclosure is not offered in a user-selected or clearly justified locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents a network call that sends credentials from environment variables in an Authorization header, but it does not include any warning about handling sensitive credentials or the privacy/security implications of transmitting them. Under the markdown-specific SQP-2 criteria, behaviors affecting privacy or system integrity should be accompanied by warnings.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L030 的注释写明“响应小于等于该字节数时，直接全量输出，不落文件”，这与 main() 的真实流程不符：L336-L347 先序列化并写入 out_path，随后 L348-L353 才决定是完整打印还是摘要输出。这里不是文档遗漏，而是对是否落盘这一关键副作用的直接矛盾描述。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.