Security audit

Walmart-关键词研究

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Walmart keyword research, but it also includes sensitive login, API-key, payment, feedback-reporting, and unclear local storage behavior that users should review before installing.

Install only if you are comfortable with LinkFox/Sorftime API calls, local storage of full responses, and the onboarding flow handling phone verification, API keys, and paid order creation. Treat any saved-keyword changes, API-key display, payment QR generation, and automatic feedback reporting as sensitive actions that should require clear user consent.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions while its documented behavior clearly requires environment access, file writes, and network calls. This under-specification prevents effective policy enforcement and informed review, and can hide meaningful data-handling and exfiltration capabilities from users or the host platform.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The described purpose is Walmart keyword research, but the referenced behavior includes SMS login, API-key retrieval, account info access, plan listing, order creation, payment QR generation, and payment-status queries. Those are materially different privileged flows involving identity, billing, and account operations, creating a strong risk of unauthorized collection or execution outside the user's research intent.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs automatic submission of feedback to a separate Feedback API based on conversation outcomes, even though that is outside the stated keyword-research function. This can transmit user content, sentiment, and task context to another service without a clear need or an explicit opt-in.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements SMS login, API-key acquisition, subscription listing, order creation, and payment QR rendering, which are materially unrelated to the declared Walmart keyword-research capability. That scope mismatch is dangerous because it introduces credential collection and billing operations into a research skill, increasing the chance of unauthorized account actions or deceptive user flows.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The order-creation and payment-QR functionality can trigger purchases and facilitate billing flows despite the skill being presented as keyword research. In this context, hidden or unnecessary monetization paths are especially risky because users would not reasonably expect a research tool to initiate subscription purchases.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This section performs SMS-based authentication and generates or retrieves API tokens, effectively acting as an account bootstrapper rather than a keyword-research helper. In the stated skill context, collecting phone numbers, verification codes, and issuing API keys is overprivileged and could expose users to credential theft, account takeover, or misuse of generated tokens.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The top-level documentation promises that output is always written under the current working directory and explicitly forbids writing to /tmp, but the implementation can fall back to ~/linkfox and the system temp directory. This mismatch can cause sensitive API responses to be stored in locations the operator did not expect, increasing the risk of unintended disclosure on shared systems or ephemeral environments.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The inline comment for _resolve_output_path states that output is written under <cwd>/linkfox, but the actual path resolver may redirect writes to ACPX_WORKSPACES, the user's home directory, or /tmp. Security-relevant documentation drift like this is dangerous because users and reviewers may make trust decisions based on incorrect assumptions about where potentially sensitive response data is persisted.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The onboarding instructions direct an operator to collect and use a user's phone number and SMS verification code to register or log in via a script, but provide no privacy, consent, retention, or secure-handling guidance for this sensitive personal data. In an agent workflow, this creates a real risk of improper collection, exposure, or misuse of authentication factors and personally identifiable information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The login command emits the obtained API key directly to stdout JSON, which can be captured by logs, transcripts, shells, orchestration layers, or other tools. Returning long-lived credentials in plain output is unsafe because it broadens exposure far beyond the intended recipient and makes accidental leakage likely.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Automatically reporting feedback derived from user expressions can disclose user-provided content, sentiment, or task details to a third-party API without explicit permission. In a commerce-research context, that may leak commercially sensitive keywords, product interests, or account-related troubleshooting details.

Static analysis

No suspicious patterns detected.