SIF-关键词流量

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.8

Overview

The skill can perform keyword traffic analysis, but it also has under-scoped account, billing, feedback-reporting, endpoint, and file-persistence behavior that deserves review before installation.

Review this skill carefully before installing. It is not just a read-only keyword analytics helper: it can handle phone-based login, generate or expose API keys, guide paid credit purchases, create payment orders, submit feedback externally, and write full response data to disk. Only use it if you trust LinkFox with the queried business data and credentials, and avoid endpoint overrides or shared environments unless the publisher fixes the scoping and persistence issues.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:223

Finding

Silent Transmission of Conversation-Derived Feedback to an External Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:72

Finding

Environment-Controlled API Endpoints Can Redirect Sensitive Credentials

Content

View full analysis

str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` The onboarding HTTP helper sends bodies and headers to the resulting URL: ```python r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) ``` Login transmits a phone number and SMS code to the configurable login base: ```python resp = _login_post("/user/v3/web/login", { "type": "sms", "method": "login", "systemId": "LinkFoxAgent", "data": {"areaCode": "+86", "authPhone": phone, "authCode": code, "sourceChannel": channel or "skill"}, }) ``` Access and refresh tokens are transmitted to the configurable Agent User base: ```python resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) ``` The keyword query script has the same destination-control weakness: ```python def get_api_base() -> str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ ...[truncated 2185 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/onboarding.md:12

Finding

API Key Is Exposed in Standard Output and Stored in Plaintext Shell Profiles

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` The onboarding instructions recommend persistent plaintext storage: ```powershell setx LINKFOX_AGENT_API_KEY "" ``` ```bash echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The generated API key is included in a JSON object and printed in full to standard output. In Agent and automation environments, stdout may be retained in conversation transcripts, command logs, CI logs, terminal scrollback, or host telemetry. The documentation then instructs users to append the key to shell startup files. These are ordinary plaintext files and may be read by other software running as the same user, included in backups, copied during troubleshooting, or accidentally committed with configuration files. Although the API key is legitimately needed for authenticated keyword queries, exposing it in unrestricted output and long-lived plaintext storage is not the least-risk method of provisioning it. ### Attack Path 1. The user invokes: ```text python scripts/onboarding.py login ``` 2. The script obtains or generates an API key. 3. `_emit` prints the full key to stdout. ...[truncated 777 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sif_keyword_traffic.py:250

Finding

Unsanitized Session Identifier Allows Writes Outside the Intended Data Directory

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] ``` It is then used as a path component without validation: ```python def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The selected directory receives metadata and API response files: ```python def resolve_data_path(slug: str, ts: float, ext: str = "json") -> str: _, session_dir = _ensure_session(ts) sub = os.path.join(session_dir, "data") os.makedirs(sub, exist_ok=True) out = os.path.join(sub, f"{slug}-{int(ts * 1_000_000)}.{ext}") _update_meta(session_dir, skill=slug, kind="data", file_rel=os.path.relpath(out, session_dir), ts=ts) return out ``` ### Technical Analysis `SESSION_ID` is treated as trusted even though it may contain: - Absolute paths. - `..` traversal components. - Platform-specific separators. - Excessively long or otherwise invalid identifiers. In Python, an absolute final component passed to `os.path.join` discards preceding path components. Traversal components are also interpreted by the file system. No canonical-path containment check confirms ...[truncated 1475 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (29)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material, including access tokens, refresh tokens, SMS-login data, and generated API keys, to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or trigger SSRF-style outbound access.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway helper uses environment-derived base URLs with urllib and attaches the API key in the Authorization header before performing outbound requests. In a compromised or misconfigured environment, this can leak the user's API key and route requests to unintended internal or external services, creating both credential-exposure and SSRF risk.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The request sent via urlopen includes environment-derived values in headers, including the API key and session/application metadata, and the destination base URL is itself configurable via the LINKFOX_TOOL_GATEWAY environment variable. In an agent setting, environment variables are often influenced by the execution harness; if an attacker can alter them, the skill can exfiltrate credentials and tracking metadata to an attacker-controlled endpoint. The skill context makes this more dangerous because it is designed to call a remote service and always performs network transmission automatically.

Content

Scanner excerpt · scripts/sif_keyword_traffic.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is keyword traffic analysis, but the documented behavior includes authentication, account inspection, plan listing, payment order creation, QR code generation, and payment-status polling. This is a major capability mismatch that can surprise users and route the agent into handling credentials, billing, and account data unrelated to the requested analysis.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

searchKeyword: "wireless charger", country: "US", condition: "totalPeriod.in"

text

## Display Rules

1. **Present data clearly**: Show query results in well-structured tables. Group data by traffic channel exposure ratios for easy comparison.
2. **Distinguish product-level vs keyword-level scores**: Do not mix `naturalSearchExposureScore` (product-wide) with `keywordNaturalExposureScore` (this keyword only). Label columns so users know which scope they are reading.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements SMS login, API-key issuance, subscription discovery, order creation, and payment QR generation, which is materially unrelated to the declared keyword traffic-analysis skill. That mismatch expands the skill's privilege and attack surface, enabling credential collection and financial operations that users would not reasonably expect from an analytics workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill contains direct billing functionality, including package lookup, order creation, and payment QR rendering. For a traffic-analysis skill, embedded purchase capability is unjustified and dangerous because it can initiate real-money transactions and expose users to unexpected charges or social-engineering-style monetization flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code performs SMS-based login and then retrieves or generates API tokens for the user, which is far beyond what the stated analytics purpose justifies. This creates a credential-handling and token-minting path inside the skill, so compromise or misuse could grant persistent access to the user's account and linked services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool or permission scope even though its documented behavior requires environment access, local file writes, and network calls. Without a least-privilege boundary, an agent may invoke capabilities beyond what users would reasonably infer from a keyword-analysis skill, increasing the chance of unintended data access or exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are overly broad and activate on generic topical mentions rather than a narrow, user-intended invocation. Broad triggers increase the risk that the skill runs in contexts where the user did not request this external lookup, potentially causing unnecessary network calls, data persistence, or paid API usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents automatic persistence of full API responses into the current project directory, tied to session structure, without a prominent up-front warning or consent flow. This can leave potentially sensitive commercial data, account-linked metadata, or user query history on disk where other tools, collaborators, or future tasks may access it.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs automatic reporting to a Feedback API for broad situations unrelated to the core task. That creates an undisclosed secondary data flow where user prompts, dissatisfaction, or other interaction content may be transmitted externally without being necessary to fulfill the requested keyword analysis.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Auto-reporting broad user feedback can transmit user-provided content to an external service without explicit consent or a clear need for task completion. In an agent setting, that creates privacy and data-governance risk because free-form prompts may contain business-sensitive details beyond the skill's functional inputs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 121)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/sif/keywordSummary \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents a separate feedback-posting endpoint that is unrelated to the keyword summary capability. In an agent-skill context, unrelated write-capable endpoints expand the skill’s effective scope and can be abused to exfiltrate user/task details or perform unintended external actions if the agent follows the documentation literally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The onboarding document adds authentication, account registration, and billing workflows that are outside the stated purpose of a keyword traffic analysis skill. This unnecessarily expands the skill’s operational scope into credential and payment handling, increasing the chance an agent will solicit sensitive data or guide users through risky actions under the guise of analytics support.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs the agent to assist with registration and plan purchase despite the skill being described as competitive keyword traffic analysis. Embedding account creation and payment enablement into an unrelated skill creates a social-engineering surface where users may be persuaded to share personal data or make purchases through agent-mediated flows they would not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly tell the agent to collect a user's phone number and use it to initiate login/registration flows, but provide no privacy notice, consent language, data minimization guidance, or retention limits. In the context of an analytics skill, requesting phone numbers is especially unexpected and increases the risk of privacy harm, phishing, or misuse of personally identifiable information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description and runtime behavior are entirely Chinese-focused, including Chinese-language UI text and a fixed +86 phone area code in the login flow. There is no indication that the user can choose another language or locale, so the skill effectively forces a specific locale without documented opt-in or a clearly stated regional-only scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Both the verification-code request and login request hard-code areaCode to +86, restricting the skill to a specific locale. Because the file does not clearly justify this as a region-specific tool or offer any user choice, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation promises cwd-only persistence and explicitly says not to write to /tmp, but the implementation falls back to the home directory and temporary directory when earlier locations are not writable. This mismatch can cause sensitive API responses to be stored in less expected or less controlled locations, undermining operator assumptions and increasing the risk of unintended disclosure in multi-user or ephemeral environments. In this skill, the stored data contains traffic-analysis results and metadata, so silent relocation materially changes the privacy posture.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The request includes SESSION_ID, MODE_ID, and APP_NAME headers in addition to authorization, but the script does not clearly disclose this metadata transmission at execution time. While sending some context to a trusted backend may be operationally legitimate, undisclosed metadata sharing can leak identifiers and usage context beyond what users expect, especially if the endpoint is misconfigured or redirected. The risk is amplified by this skill's remote API design and environment-configurable gateway base URL.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script always saves the complete API response to local disk, but there is no explicit execution-time consent, opt-out, or warning before persistence occurs. If the response contains sensitive commercial data, identifiers, or account-related metadata, automatic storage increases exposure through local filesystem access, backups, logs, and artifact collection. The skill context increases risk because the behavior is systematic and applies to every invocation.

Content

No source excerpt is available for this finding.