Sorftime-商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.7

Overview

The skill appears to perform Amazon product search, but it also handles login, API keys, payment ordering, local storage, and silent feedback reporting in ways users should review before installing.

Review carefully before installing. Use this only if you trust LinkFox/Sorftime with your Amazon product queries, phone-based login flow, API key, account details, and payment ordering. Avoid setting endpoint override environment variables unless you control the destination, and clear local linkfox output/cache folders if stored query results or payment QR files should not persist.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, and the request can carry sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. If an attacker can influence environment variables, they can redirect these requests to an attacker-controlled endpoint and exfiltrate credentials or session material.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL is also environment-derived and used for authenticated urllib requests with the Authorization header populated from LINKFOX API key material. An attacker who controls the runtime environment can redirect these requests and capture API keys, user/account data, order details, and other authenticated traffic.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request URL is derived from LINKFOX_TOOL_GATEWAY, an environment variable, and the script sends the API key plus session metadata headers to that destination without validation. In an agent/runtime setting, a manipulated environment can redirect requests to an attacker-controlled host, causing credential exfiltration and leakage of user query data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet the documentation instructs use of environment variables, persistent file writes, and network/API access. This creates a transparency and least-privilege problem: operators and users cannot accurately assess what resources the skill will touch, and hidden capability use can lead to unintended data exposure or policy bypass in agent runtimes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is Amazon product search, but the finding indicates additional account and payment-related behaviors such as SMS login, API key generation, user/team info access, subscription listing, order creation, payment QR generation, and payment-status queries. That is a major scope expansion into identity, billing, and account operations, which could expose sensitive data or trigger unauthorized financial actions if invoked unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill adds automatic Feedback API reporting that is outside its stated product-search purpose. Silent transmission of user reactions, dissatisfaction, praise, or improvement suggestions can leak user content or behavioral metadata to a third party without clear necessity or informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Auto-reporting perceived improvements and user feedback is not justified by the core search/filter function and invites unnecessary exfiltration of conversational data. Because the trigger includes subjective judgments by the agent ('anything you believe could be improved'), it risks over-collection and unpredictable disclosure of user information.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The API reference adds a separate feedback submission endpoint unrelated to the stated product-query capability, which expands the skill's data flow beyond user expectations. This creates a realistic risk that an integrating agent may send user prompts, complaints, or other content to a third-party endpoint without clear consent or tight purpose limitation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The onboarding document adds authentication recovery, phone-based registration, and billing/payment workflows that are outside the stated purpose of an Amazon product-query skill. This expands the skill into credential and payment handling, increasing attack surface and creating opportunities for social engineering, secret collection, and unauthorized monetization if the referenced script or workflow is abused.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documented behavior instructs the agent to collect phone numbers, perform login/registration, and initiate plan purchases, none of which are justified by a product search feature. In the context of this skill, these capabilities are especially risky because they normalize collecting sensitive user data and driving payments through agent-controlled steps unrelated to the business function.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS login, API-key retrieval, subscription listing, ordering, and payment QR generation, which are materially unrelated to an Amazon product search/query skill. That scope mismatch is dangerous because it expands the skill from data retrieval into credential collection and monetization flows that can harvest user secrets and trigger purchases.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can create orders, fetch package data, and render payment QR codes, enabling billing actions inside a skill that should only perform product search and analysis. In this context, hidden commerce capabilities increase the risk of unauthorized charges, deceptive upsells, or coercing users into off-scope payment flows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill performs SMS-based login and then retrieves or generates API tokens for the user, which is far beyond the justified scope of a product-query tool. This is highly sensitive because it turns the skill into a credential and token provisioning mechanism, enabling account takeover or unauthorized API use if abused.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script always persists full API responses, cache entries, and session metadata to local storage, which goes beyond simple product-query execution and can retain potentially sensitive business queries, result data, and identifiers. In shared or long-lived workspaces, this increases exposure through unintended retention, cross-session access, and secondary leakage from cache or metadata files.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring states that writing to /tmp is forbidden and that the current directory must be writable, but the actual implementation falls back to the home directory and then the system temp directory. This mismatch is security-relevant because operators may rely on the documented storage guarantees while the code silently writes sensitive response data to less controlled locations.

Vague Triggers

High

• Confidence: 86% confidence
• Finding: The trigger criteria are extremely broad, including many generic product research and comparison intents even when Sorftime is not mentioned. Over-broad activation can cause unintended tool use, unnecessary paid API consumption, unanticipated data transmission, and execution of side behaviors such as local storage or feedback reporting without the user's clear intent.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs persistent writes of full API responses into the local project directory, organized by date and session, without a clear user-facing privacy and retention warning. Search responses may contain sensitive business data, account-linked metadata, or identifiers, and storing them by default increases the risk of later disclosure to other tools, users, or repository processes.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation explicitly instructs sending feedback content to a separate external endpoint but does not include any user-facing warning, consent requirement, or privacy guardrails. In an agent setting, this can lead to silent exfiltration of user text, including potentially sensitive business context, to a service outside the core product search workflow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell the operator to handle user phone numbers and verification-code login through a script but provide no privacy notice, retention limits, or safe-handling requirements. That creates unnecessary exposure of personal data and authentication factors, which could lead to account compromise or privacy violations if mishandled or logged.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs users to persist API keys in shell startup files without warning about local credential exposure, shell history leakage, shared-account risks, or safer secret-management alternatives. While common in developer workflows, embedding this in a general-purpose skill increases the chance of insecure credential storage and accidental disclosure.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: The code creates session directories under workspace/home/temp locations and writes QR PNG files there without clear user warning or retention controls. In shared or multi-tenant environments, local artifacts can be discovered by other processes or users, exposing payment links or usage metadata.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 83% confidence
• Finding: This code transmits user-supplied and credential-bearing data to external services, including login and token flows. External transmission is expected for a networked skill, but here it becomes security-relevant because the same module handles highly sensitive authentication material and allows endpoint override via environment configuration.

Static analysis

No suspicious patterns detected.