Sorftime-Walmart类目市场研究

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.1

Overview

This Walmart research skill is not clearly malicious, but it needs Review because it adds account login, API-key generation, payment ordering, automatic feedback reporting, and broad local saving around a paid research API.

Review this before installing if you are comfortable with a paid LinkFox integration that can use your API key, collect phone/SMS login data during onboarding, create payment orders when you explicitly select a plan, send automatic feedback to LinkFox, and save full API responses locally. Prefer self-service API-key setup, keep LINKFOX_* endpoint variables trusted, and avoid running the billing/onboarding commands unless you intend to manage payment or account access through the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and API-token requests, to those endpoints via requests.post. If an attacker can influence environment variables in the execution context, they can redirect authentication traffic and credential material to attacker-controlled servers, making this an SSRF/exfiltration risk rather than a harmless configuration pattern.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway URL is derived from environment variables and used in urlopen with the Authorization header populated from LINKFOX API keys. An attacker who controls those environment variables can redirect authenticated requests, causing API-key disclosure to an attacker endpoint and enabling unauthorized use of the user's account or credits.

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request destination and outbound headers are influenced by environment variables, notably LINKFOX_TOOL_GATEWAY and SESSION_ID/MODE_ID/APP_NAME, and are sent via urlopen without validating the destination. In an agent environment, a malicious or compromised runtime can redirect requests to an attacker-controlled host and exfiltrate the API key, user-supplied parameters, and session metadata.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions while instructing use of environment variables, network calls, and persistent file writes. This undermines transparency and permission scoping, making it harder for users and reviewers to assess what data the skill can access or exfiltrate, especially because outputs are always written locally and credentials are read from the environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is Walmart category research, but the skill reportedly includes flows for SMS login, API key generation/retrieval, account access, subscription purchase, payment QR generation, and order status queries. That is a major capability expansion into authentication and billing functions unrelated to the stated task, creating strong risk of credential harvesting, unauthorized account actions, or induced purchases under misleading pretenses.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to automatically send feedback and intent/result mismatch information to a separate Feedback API, which is outside the user-requested Walmart research scope. This creates a data-sharing channel that may transmit user content or behavioral metadata to another service without necessity for the primary function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This onboarding script performs SMS login, API-key retrieval, subscription discovery, and payment operations even though the declared skill is for Walmart category research. That mismatch is dangerous because it expands the skill into credential collection and commerce flows unrelated to user expectations, increasing the chance of deceptive account takeover, unauthorized billing, or secret harvesting.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The billing and order-creation logic lets the skill place orders and generate payment QR codes, which is unrelated to Walmart category analysis. In this context, hidden monetization capability is especially risky because users invoking a research tool would not reasonably expect a skill to create payable orders, enabling deceptive charging or social engineering.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script implements SMS login and API-token generation, allowing the skill to turn a phone number and verification code into reusable API credentials. Because this is not justified by the stated category-research purpose, it represents covert credential acquisition and materially increases the risk of account compromise and unauthorized API use.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation states outputs are always written under the current working directory and explicitly forbids /tmp, but the implementation can fall back to ~/linkfox or the system temp directory. This mismatch is security-relevant because users and orchestrators may rely on the documented storage boundary when handling sensitive market data or session artifacts.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The path-resolution helper claims data is stored under <cwd>/linkfox, but it actually delegates to logic that may choose ACPX_WORKSPACES, the home directory, or the temp directory. This contradiction can undermine isolation assumptions and cause sensitive API responses to be persisted in less controlled locations than operators expect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes automatic reporting to a Feedback API without a user-facing privacy warning or consent step. That can cause silent disclosure of user inputs, dissatisfaction signals, or task details to a third party, which is especially problematic when the skill also handles account, billing, or API key onboarding scenarios.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding instructions explicitly tell the operator to collect a user's phone number and use it to send a verification code and log in, but they provide no privacy notice, consent language, retention guidance, or data-handling limits. This creates a real privacy and security risk because personal data is being solicited and transmitted through a workflow that may not be transparent to the user.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The login command emits the API key directly in stdout JSON, which may be captured by calling agents, logs, shell history wrappers, or workflow transcripts. Exposing long-lived credentials in normal output substantially increases accidental leakage risk, especially in agentic environments where stdout is often persisted or forwarded.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill sends user-provided parameters together with environment-derived session metadata to a remote API, but there is no runtime warning, consent prompt, or minimization of metadata. In agent contexts, users may not realize their query content and internal identifiers are being transmitted off-box, increasing privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script always persists the full API response to disk regardless of size, while only varying what is printed to stdout. If the response contains sensitive business data, identifiers, or unexpected secrets, this creates local data-at-rest exposure without a clear runtime warning or retention control.

Static analysis

No suspicious patterns detected.