SIF-关键词流量

• Outcome: Review
• Latest audit: Aug 21, 2026 · 10:34 AM UTC
• Version: 1.0.8

Overview

This skill mostly matches its advertised Amazon keyword traffic analysis purpose, but it also includes high-impact login, billing, token-generation, and automatic feedback-reporting behavior that users should review before installing.

Install only if you trust LinkFox with keyword/ASIN queries, account onboarding data, and billing interactions. Prefer self-service API key setup when possible, avoid entering SMS codes through an agent unless you intend to link the account, review any plan/order before payment, and be aware that full responses are stored locally and feedback may be sent to a separate LinkFox feedback service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication traffic to attacker-controlled infrastructure and capture credentials or tokens.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request path uses an environment-derived base URL and attaches the API key in the Authorization header before calling urlopen. A manipulated runtime environment could redirect these requests to an attacker endpoint, causing API key exfiltration and unauthorized use of the user's account or paid services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions, yet its documented behavior uses environment variables, persistent file writes, and network access. This breaks least-privilege expectations and prevents users or the platform from accurately understanding what capabilities are being exercised, which increases the chance of unauthorized data access or exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a keyword traffic analysis tool, but the detected behavior includes SMS-based login, account access, subscription discovery, order creation, payment initiation, QR code generation, and payment-status polling. Those account and payment flows are materially outside the stated purpose, creating a serious risk of unexpected credential handling, financial actions, and collection of sensitive user/account data under the guise of analytics.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file documents a separate feedback-posting endpoint unrelated to the stated keyword traffic analysis function, expanding the skill's effective capability beyond user-expected scope. In an agent setting, this can enable unintended outbound writes of user content or interaction summaries to a third-party service, creating data exfiltration, privacy, and prompt-injection risk if the agent is induced to call it.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS authentication, API key issuance, package listing, ordering, and payment handling, which is materially unrelated to the declared keyword traffic analysis skill. That mismatch increases risk because the skill requests or enables sensitive account and commerce operations beyond user expectations, expanding the attack surface and enabling abuse under the guise of analytics.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script can create orders and render payment QR codes even though the advertised purpose is traffic-source analysis for keywords and ASINs. In skill context, hidden commerce functionality is especially dangerous because it could induce unanticipated purchases or facilitate social engineering by presenting billing flows as part of normal analytics setup.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs SMS login, token-based account bootstrap, team/user enumeration, and API token retrieval/generation, which far exceeds the minimum privileges implied by a keyword-analysis skill. Because this capability can mint reusable API credentials, compromise or misuse could lead to broader account takeover or unauthorized access to the vendor platform.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger text is overly broad and instructs activation whenever a user's request merely relates to competitor ASIN traffic-source analysis, even without explicit mention of the tool. Overbroad activation increases the chance the skill runs in contexts the user did not intend, causing unnecessary external calls, extra charges, or inappropriate handling of user data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs operators to collect and process a user's phone number and SMS code through a script-based registration flow, but it provides no privacy notice, consent guidance, data-handling limits, or masking requirements. This creates a real risk of unnecessary collection or disclosure of sensitive personal data and could expose users to privacy, compliance, and account-takeover issues if mishandled.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions tell operators to run commands that permanently modify shell startup files or environment configuration, but they do not clearly warn that these changes are persistent and affect future sessions. That can lead to unintended system changes, secret exposure in shell history or dotfiles, and difficult-to-reverse configuration drift on the user's machine.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script transmits phone numbers, SMS verification codes, access tokens, and refresh tokens to remote services, but the file itself contains no clear user-facing disclosure about the sensitivity of that data flow. In the context of a skill advertised for analytics, undisclosed collection and transmission of authentication factors is more concerning because users may not anticipate identity or account linkage operations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script always persists the full API response to local disk, including when the response may contain sensitive business data, but it does not provide a clear runtime disclosure or opt-in before doing so. In agent environments, automatic persistence increases the chance of unintended retention, later exfiltration, or access by other users/processes through shared workspaces, home directories, or temp-backed fallback paths.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends SESSION_ID, MODE_ID, and APP_NAME from the environment in outbound HTTP headers without any user-facing disclosure at execution time. While this may be intended for platform telemetry or routing, it can leak internal identifiers and usage context to the remote service, which is more sensitive in an agent skill because users may not realize their session metadata is being transmitted alongside the request.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs persistent storage of full API responses into session-linked local files and printing them to stdout under some conditions. This creates unnecessary retention of potentially sensitive business queries, account-related metadata, and identifiers in plain files tied to a session, increasing exposure through local compromise, logs, backups, or later unintended reuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: External transmission is expected for login and service integration, but here the transmitted payloads include highly sensitive authentication data and token material. Combined with the skill's misleading analytics framing and environment-configurable endpoints, the outbound transmission meaningfully increases risk of credential exposure.

Static analysis

No suspicious patterns detected.