SIF-关键词概览

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:34 AM UTC
• Version: 1.0.8

Overview

The skill’s keyword-analysis function is plausible, but it also handles login, API-key setup, payments, persistent credentials, configurable secret-bearing endpoints, and automatic feedback reporting that deserve review before installation.

Review this skill before installing. Use it only if you trust LinkFox with your keyword queries, API key, session metadata, phone-based onboarding flow, billing actions, and automatic feedback submissions. Confirm any LINKFOX_* endpoint environment variables point to legitimate LinkFox domains, and do not provide SMS codes or create payment orders unless you explicitly intend to register or recharge the account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code sends authentication material and other sensitive data to URLs derived from environment-controlled base endpoints via requests.post. If an attacker can influence LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect SMS login tokens, access tokens, refresh tokens, and generated API tokens to attacker-controlled infrastructure. The danger is amplified because this skill is unrelated to keyword overview analysis, so onboarding and credential flows are unjustified in context.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request path uses urllib with a URL built from environment-controlled base configuration and automatically attaches the API key in the Authorization header. If LINKFOX_AGENT_API_URL or its fallback is maliciously set, the skill will exfiltrate the API key and potentially billing/order actions to an attacker-controlled server. Because the skill also supports purchasing and order queries, this can expose credentials and enable abuse of the linked account.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request sent via urlopen includes sensitive environment-derived headers, including the API key and session metadata, and the destination host is configurable through LINKFOX_TOOL_GATEWAY. If an attacker can influence that environment variable, they can redirect the request to an attacker-controlled server and exfiltrate credentials and workflow metadata. In an agent/skill context, trusting environment-configured network destinations is more dangerous because the runtime commonly injects privileged secrets into the environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions, yet its instructions clearly require access to environment variables, filesystem writes, and network APIs. This creates a transparency and consent problem: the agent may handle secrets, write persistent data, and make external requests without those capabilities being explicitly disclosed or gated. In this context, the hidden capabilities are more dangerous because the skill also discusses authentication and paid API usage, increasing the chance of secret handling and unintended external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a keyword competition overview tool, but the referenced behavior expands into authentication, account retrieval, purchasing plans, order creation, payment QR generation, and payment-status polling. That is a material scope expansion from analytics into account and financial operations, which could mislead the agent into performing sensitive actions the user did not request. The mismatch is especially dangerous because onboarding text is invoked for 401/402 and balance issues, creating a path from benign analysis to account/payment workflows.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to automatically send user satisfaction, dissatisfaction, or improvement feedback to a separate Feedback API without asking the user. That is an unnecessary secondary data transfer unrelated to the core keyword-analysis function, and it may exfiltrate user sentiments, prompts, or contextual details to another service. The risk is higher here because the reporting is framed as automatic and non-interrupting, which reduces transparency and meaningful consent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file documents a separate feedback API that is unrelated to the declared keyword overview capability, expanding the skill's effective action surface beyond the user-expected data retrieval function. In an agent setting, this can enable unintended outbound reporting of user content or interaction details to a third-party endpoint, creating privacy, consent, and prompt-manipulation risks if the agent is induced to call it.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS login, API key acquisition, plan purchasing, and payment QR generation, none of which are necessary for an Amazon keyword competition overview skill. This scope mismatch is a strong indicator of hidden capability insertion: the skill can collect credentials, mint tokens, and initiate commercial flows under a misleading manifest. The contextual mismatch makes the behavior substantially more dangerous.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section performs SMS-based authentication and API token retrieval/generation, allowing the skill to turn a phone number and verification code into long-lived access credentials. In the context of a keyword competition analytics skill, this is unjustified and creates a direct path to credential capture and account takeover of the linked service. The mismatch between declared purpose and implemented capability materially raises risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code lists subscription plans, creates orders, and renders payment QR codes, which exceeds the stated analytics scope and introduces monetization and transaction capabilities into an unrelated skill. This can be abused to steer users into purchases or to trigger account-linked billing flows under false pretenses. While not as severe as token theft, it is a significant trust and abuse issue in this context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.