T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:204- Finding
Automatic Transmission of Conversation-Derived Feedback Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Sorftime-商品搜索
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate product-search function, but it also includes sensitive account, payment, credential, persistence, and automatic feedback behavior that needs review before installation.
Install only if you are comfortable with LinkFox/Sorftime receiving search requests and, during onboarding, phone-authentication and payment-related data. Avoid custom endpoint environment variables unless you trust them, do not paste API keys into shared logs or shell history, review stored files under linkfox directories, and require explicit consent before submitting feedback or creating payment orders.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sorftime_product_search.py:36- Finding
Credential-Bearing Requests Can Be Redirected to Arbitrary Environment-Controlled Destinations
- Content
View full analysis
str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding independently supports additional destination overrides: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Sensitive tokens are then sent to the selected destination: ```python resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": { "aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome", }, }, _headers( "agent-linkfox-web", "agent.linkfox.com", acce ...[truncated 2014 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/onboarding.py:484- Finding
API Key Is Exposed Through Standard Output and Plaintext Shell Configuration
- Content
View full analysis
None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print( f"{TAG} API key retrieval succeeded " f"(source: {r['source']})", file=sys.stderr, ) return 0 return 1 ``` The onboarding documentation recommends persistent plaintext storage through commands equivalent to: ```powershell setx LINKFOX_AGENT_API_KEY "" ``` ```bash echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login command returns the complete API key in a dictionary and serializes it directly to stdout. In an Agent environment, stdout may be retained in: - Conversation transcripts. - Command execution logs. - CI logs. - Terminal scrollback. - Debugging captures. - Host telemetry. The recommended shell commands additionally place the secret in command history and persist it in plaintext startup files. Shell profiles are not dedicated secret stores and may be copied into backups, support bundles, or shared configuration repositories. ### Attack Path 1. A user runs `onboarding.py login` with a valid phone number and verification code. 2. The script obtains or generates an API key. 3. The ...[truncated 900 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sorftime_product_search.py:237- Finding
Unsanitized Session Identifier Allows Directory Traversal and Arbitrary-Location Writes
- Content
View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] ``` ```python def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The same issue exists in onboarding: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is trusted as a filesystem path component without validation. Python's `os.path.join` does not constrain the resulting path beneath the intended root: - An absolute `SESSION_ID` can discard preceding components. - A value containing `..` can traverse to parent directories. - Platform-specific separators can introduce additional path components. The product-search script writes full API responses and metadata beneath the resulting directory. The onboarding script can write generated payment QR images there. ### Attack Path 1. An ...[truncated 1267 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sorftime_product_search.py:202- Finding
Complete Responses and Payment Artifacts May Fall Back to Shared Temporary Storage
- Content
View full analysis
str: cached = _SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) import tempfile candidates.append(os.path.join(tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _SESSION_CACHE["_root"] = root return root ``` Complete responses are written without explicitly restrictive permissions: ```python serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = int(time.time()) out_path = _resolve_output_path(ts) try: with open(out_path, "w") as f: f.write(serialized) print( f"Saved full response: {out_path} " f"({len(serialized)} bytes)" ) except OSError as e: print(f"Failed to save to {out_path}: {e}", file=sys.stderr) ``` The implementation conflicts with the documented behavior, which states that temporary-directory writes are prohibited and an unwritable current directory should produce an error. ### Technical Analysis If the preferred workspace and current-directory locations are unavailable, both scrip ...[truncated 1671 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/onboarding.py:164- Finding
Runtime Installation Guidance Uses Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)
Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 94% confidence
- Finding
The code builds destination URLs from environment-controlled base URLs and then sends SMS-login data, access tokens, refresh tokens, and API-token requests to those endpoints via requests.post. If an attacker can influence environment variables in the skill runtime, they can redirect these sensitive flows to attacker-controlled infrastructure, causing credential exfiltration and unauthorized account access.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 93% confidence
- Finding
The gateway request path uses an environment-derived base URL and sends authenticated requests with the LINKFOX agent API key in the Authorization header through urllib.request.urlopen. A maliciously set environment variable can redirect these authenticated calls to an attacker-controlled server, exposing API keys and account/order data.
- Content
python headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code
Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else ""
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill advertises rich marketplace coverage, historical snapshots, and multiple analysis modes, but the implementation is described as largely proxying a single API call while also adding undeclared persistence and caching. This mismatch is dangerous because users and reviewers may underestimate what data is being stored locally and overtrust claims about validation, site support, or historical-query behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill advertises rich marketplace coverage, historical snapshots, and multiple analysis modes, but the implementation is described as largely proxying a single API call while also adding undeclared persistence and caching. This mismatch is dangerous because users and reviewers may underestimate what data is being stored locally and overtrust claims about validation, site support, or historical-query behavior.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
queryMode: 1, queryType: 4, queryValue: AnkerDirect, marketplace: us
text ## Display Rules 1. **Present data only**: Show query results in clear tables without subjective business advice 2. **Ranking clarification**: When showing ranking data, remind users that lower values mean better rankings
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # Sorftime 亚马逊产品搜索 API 参考 ## 调用规范
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The onboarding document introduces authentication recovery, scripted phone-based registration, API key acquisition, and billing/payment flows that are outside the stated purpose of an Amazon product-search skill. This expands the skill into account lifecycle and payment handling, creating an unexpected trust boundary where an agent may collect credentials or drive payments without clear product justification.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documented capability to register users by phone, retrieve API keys, and initiate payment orders is not justified by the skill's declared function of product discovery and analysis. An agent following these instructions could solicit sensitive data and perform high-risk account or payment actions under the guise of a low-risk research skill.
- Content
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md 证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`） - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file implements account onboarding, SMS verification, API-key issuance, package listing, order creation, and payment QR generation, which are unrelated to the declared Sorftime Amazon product-search purpose. This capability mismatch is dangerous because it can trick users or host systems into executing identity, billing, and credential workflows under the guise of a benign research/search skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill includes package purchase, order creation, and payment QR rendering despite being presented as an Amazon product-search tool. In this context, embedded billing flows are unjustified and increase the risk of deceptive purchases, financial abuse, and unauthorized monetization from within the agent environment.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file performs SMS-based authentication, obtains access and refresh tokens, queries user/team info, and generates API tokens, none of which are necessary for product search. In the context of this skill, these flows create a covert credential-harvesting and account-provisioning surface that is far more dangerous than the declared functionality suggests.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill uses sensitive capabilities (environment-variable access, file writes, and network access) but does not declare any tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it harder for reviewers or runtimes to constrain what the skill can do, especially since it also persists responses locally and depends on API credentials.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger criteria are intentionally broad enough to capture general Amazon product-research requests even when the user does not mention Sorftime. Overbroad activation can cause the skill to run in contexts the user did not intend, increasing accidental data exposure, unnecessary external calls, and unwanted credit consumption.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction explicitly sets the default marketplace to US whenever the user does not specify a marketplace. This forces a locale/region selection rather than asking the user to choose, which is a natural-language locale policy concern under the stated rules.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to automatically submit feedback to a separate API whenever various conditions occur, even though this is unrelated to product search. That creates an undeclared outbound data flow that may transmit user content, usage patterns, or sentiments to another service without clear necessity or consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
}
text ## curl 示例 **单条件 - ASIN同类产品：**
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file documents a second API that is unrelated to the declared product-query function of the skill. That extra endpoint sends free-form content to an external service, expanding the skill's data-flow and trust boundary in a way users and integrators may not expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The feedback endpoint encourages sending user-derived content to an external server but does not require a warning, consent step, or data-minimization guidance. This creates privacy and compliance risk because conversations, complaints, or other sensitive text could be transmitted off-platform without the user's informed approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions direct the agent to ask for a user's phone number and pass it to a script for registration and SMS verification, but they provide no privacy notice, purpose limitation, retention statement, or warning that personal data will be transmitted externally. This creates unnecessary privacy and social-engineering risk, especially because the skill's advertised purpose does not imply handling personal identifiers.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module self-describes as a LinkFox account and environment onboarding CLI, directly contradicting the published Sorftime Amazon product-search description. This discrepancy is a strong indicator of deceptive packaging, making the surrounding credential and payment functionality more suspicious and increasing the likelihood of misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and all user-facing help/messages are written in Chinese, which imposes a specific language on users. The file does not offer a language/locale choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The token-generation flow transmits phone-authenticated session credentials and requests long-lived API tokens without any local user warning or explicit consent checkpoint in the code path. In a mislabeled skill context, this increases the risk that users or orchestrators hand over sensitive account access without understanding the consequences.
- Content