Security audit

Sorftime-商品详情

Security checks for vulnerabilities and agentic risk

Overview

The skill can perform the advertised ASIN product lookup, but it also handles account login, API keys, payment orders, persistent local storage, and automatic feedback reporting in ways users should review carefully before installing.

Install only if you are comfortable with LinkFox receiving ASIN queries and account-related data, and avoid using the SMS login or payment-order flows through the agent unless you explicitly intend to. Treat any printed API key as exposed, prefer a proper secret store over shell startup files, and review or disable automatic feedback reporting before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:165
Finding: Automatic Transmission of User Feedback and Intent Without Explicit Consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sorftime_product_detail.py:37
Finding: Credential-Bearing Requests Can Be Redirected to Arbitrary Environment-Controlled Endpoints
Content: View full analysis
str: """网关基础地址：env LINKFOX_TOOL_GATEWAY 优先，缺省回退正式地址。""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` The resulting URL receives the API key and environment metadata: ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding also accepts environment-controlled login, user, and gateway bases: ```python def _env_base(name: str, default: str, *fallbacks: str) -> str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive headers ar ...[truncated 3632 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/onboarding.py:468
Finding: API Key Is Printed to Standard Output and Recommended for Plaintext Persistent Storage
Content: View full analysis
dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: 手机号格式不正确: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: 验证码格式不正确: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}（不影响拿 key）", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token(lg["access_token"], lg["user_id"], info["group_id"]) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The complete result is emitted to stdout: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The onboardin ...[truncated 2118 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sorftime_product_detail.py:251
Finding: Unsanitized Session Identifier Allows Output-Path Escape
Content: View full analysis
str: """优先 env SESSION_ID；缺省按 HHMMSS-<6 hex> 生成（同一进程内稳定）。""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """返回 (linkfox_root, session_dir)；session_dir 一定存在。""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script has the same pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a directory component without validation. Python's `os.path.join` does not guarantee containment when an untrusted component is absolute or contains traversal sequences. Examples of unsafe values include: ```text ../../outside ../../../home/user/target /absolute/attacker/chosen/path ``` The scripts subsequently create session metadata, product-response files, and payment QR images beneath the derived directory. No canonicaliz ...[truncated 1512 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/onboarding.py:162
Finding: Unpinned Runtime Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` It also relies on `requests` without a locked dependency manifest: ```python try: import requests except ImportError: requests = None # 登录/agent-user 链路调用时再报错 ``` No requirements file, lockfile, version constraints, hashes, or package-index restrictions are present in the audited project. ### Technical Analysis The command `pip install qrcode pillow` resolves mutable package versions from the user's configured Python package index. The resulting code may vary over time or be sourced from an untrusted mirror. The same reproducibility issue applies to the undeclared `requests` dependency. This is not evidence that the named packages are malicious. The risk is that the Skill instructs users to introduce unreviewed, mutable third-party code into the execution environment without integrity verification. Python packages can execute code during installation and are imported into the onboarding process, which handles account tokens and payment-related data. ### Attack Path 1. The onboarding process lacks the QR dependency. 2. The script advises the user to execute `pip install qrcode pillow`. 3. Pip resolves packages using mutable versions and the user's configured index or mirror. 4. A compromised release, compromised mirror, or maliciously altered dependency is installed. 5. Package code executes during installation or import. 6. Malicious dependency code runs with ...[truncated 642 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (26)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 94% confidence
Finding: The request headers include environment-derived values such as Authorization, SESSION_ID, MODE_ID, and APP_NAME, and the destination host is configurable via LINKFOX_TOOL_GATEWAY. This creates a real exfiltration risk: if an attacker can influence environment variables, the script can be redirected to an attacker-controlled server and will send secrets and session metadata in the outbound request.
Content: Scanner excerpt · scripts/sorftime_product_detail.py (reported line 79)May include surrounding context.
python
method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to provide ASIN product-detail and trend lookup, but the documented behavior expands into account login, API key generation, billing/package lookup, payment order creation, QR-code payment flows, and payment-status checks. That mismatch is dangerous because it can steer an agent into handling authentication and financial operations the user did not request, exposing users to credential misuse, unexpected charges, and privacy risks.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger is intentionally broad enough to activate on generic ASIN-related requests even when the user did not ask for Sorftime specifically. Overbroad triggering is dangerous because it can cause unnecessary third-party API calls, consume paid credits, and send user-derived product queries to an external service without clear intent or informed consent.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
- **BSR rank trends**: for `bsrRankTrend`, format is `[{NodeId: xxx, Rank: [date, rank, ...]}]` per sub-category - **Deal trend**: value `1` = has active Deal that day, `0` = no Deal ## Display Rules 1. **Present data only**: Show query results in clear tables without subjective business advice 2. **Ranking clarification**: When showing ranking data, remind users that lower values mean better rankings

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The onboarding document introduces authentication recovery, phone-based account registration, and billing workflows that are materially unrelated to the skill's declared purpose of querying Amazon ASIN product details and trends. This scope expansion increases attack surface and can normalize collection of credentials, phone numbers, and payment actions in a context where users would not reasonably expect them.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented capability asks operators to collect a phone number, run registration/login scripts, and facilitate payment-plan purchases for an ASIN lookup skill. In this context, those flows are unjustified and create opportunities for social engineering, unauthorized account actions, and unnecessary handling of sensitive personal and financial data.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`） - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script implements SMS login, API key issuance, subscription management, and payment QR generation, which are materially outside the declared ASIN product-detail/trend query purpose. This scope mismatch is dangerous because it expands the skill from read-oriented data lookup into account onboarding and financial operations, increasing the chance of unauthorized credential handling, billing actions, and user confusion.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Billing and payment order creation are unrelated to the stated ASIN lookup/trend-analysis functionality, yet the code can create orders and render payment QR codes. In a skill ecosystem, hidden or weakly disclosed payment capability is dangerous because it can trigger financial transactions users did not expect from a product-detail tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The login flow returns a live API key in stdout JSON, which may be captured by logs, calling frameworks, chat transcripts, or other tooling layers. Emitting secrets through standard output is dangerous because it creates multiple uncontrolled persistence points and substantially raises the risk of credential leakage and downstream account compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation contradicts its own documented storage guarantees by falling back to home or temporary directories, including /tmp-derived paths, when the preferred directory is not writable. This can undermine operator expectations and cause sensitive response data to be written into less controlled or more exposed locations than advertised.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill describes capabilities that access environment variables, write files, and perform network requests, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization ambiguity where an agent may invoke broader capabilities than a user would reasonably expect, increasing the risk of unintended secret access, local data writes, or outbound requests.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill adds a broad, always-on feedback reporting instruction that is unrelated to the core ASIN lookup function and can be triggered by general user sentiment or model judgment. This creates an unnecessary secondary data egress path where user prompts, outcomes, or dissatisfaction signals may be transmitted to another API without focused consent or need.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api.md (reported line 129)May include surrounding context.
}

text
## curl 示例 ```bash curl -X POST https://tool-gateway.linkfox.com/sorftime/amazon/productDetail \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file documents a second API for submitting feedback that is unrelated to the stated ASIN product-detail function. In an agent-skill context, unrelated outbound endpoints expand the skill's capability surface and can enable unauthorized exfiltration of user content or behavioral telemetry to a separate service, especially because the payload explicitly includes free-form content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instructions tell operators to have users provide phone numbers and verification codes so a script can register or log in, but there is no privacy notice, consent language, retention guidance, or transmission-handling warning. That omission makes accidental mishandling of personal data more likely and can condition users to share sensitive information in an unsafe channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document provides commands that persist API keys into shell startup files and environment configuration without warning the user that this permanently modifies local configuration and may expose secrets to other local processes or future sessions. While not inherently malicious, secret persistence guidance without safeguards increases the risk of credential leakage and misconfiguration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language interface and command descriptions are entirely in Chinese, and the code enforces a domestic 11-digit phone format with area code +86, indicating a fixed locale and regional assumption. There is no visible language or locale choice, opt-in, or documented justification in this file for restricting use to Chinese-speaking or China-based users.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs SMS authentication, token-based login, team/user info retrieval, and API key generation despite the skill being described as a product-detail/trend query tool. This unnecessary credential and token lifecycle handling increases the attack surface and can expose users to credential capture or misuse if the skill is invoked in unexpected contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script always writes the complete API response to disk regardless of size, and only comments/docstrings disclose this behavior. Unconditional persistence can expose potentially sensitive response content and session-associated artifacts to other local users, backups, or later processes without meaningful user consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script persists full API responses plus session metadata to local files and maintains cache/index metadata, which exceeds a simple query-and-return behavior and increases data retention risk. If the API response contains sensitive business data, identifiers, or usage metadata, this creates unnecessary local exposure and a broader privacy/security footprint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The activation and instruction text is partially written in Chinese and partially in English, but nowhere indicates that the user may choose their preferred language for interaction or output. This can create an implicit language/locale constraint without opt-in, which falls under the language policy check.
Content: No source excerpt is available for this finding.