Walmart-关键词研究

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.1

Overview

This looks like a real Walmart keyword-research skill, but it needs review because it can handle account/billing flows, send credentials to configurable network endpoints, write sensitive local outputs, and auto-report feedback without clear consent.

Install only if you are comfortable using LinkFox/Sorftime as a paid external service and handling API keys, phone-based login, saved-keyword mutations, and billing/order actions through this skill. Before use, keep gateway/login endpoint environment variables unset unless you fully trust them, review any favorite changes or purchases before approval, avoid sharing unnecessary phone or business-sensitive query details, and disable or decline feedback reporting unless you intend to send that context to LinkFox.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sorftime_walmart_keyword_research.py:46

Finding

Environment-controlled endpoints can receive authentication credentials

Content

View full analysis

str: return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request(api_url, data=data, headers=headers, method="POST") with urlopen(req, timeout=120) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding flow similarly derives credential-bearing destinations from environment variables: ```python def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") def _login_by_token(access_token: str, refresh_token: str) -> dict: resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": { "aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome", }, }, _headers( "agent-linkfox-web", "agent.linkfox.com", access_token=access_token, )) ``` ### Technical Analysis The s ...[truncated 1756 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sorftime_walmart_keyword_research.py:257

Finding

Unsanitized SESSION_ID enables output-path traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding implementation has the same issue: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted path component. The code does not reject: - Absolute paths. - `..` traversal components. - Platform-specific path separators. - Drive-qualified paths on Windows. - Symbolic-link escapes. With `os.path.join`, an absolute final component can replace the intended prefix. Relative traversal components can escape the dated session directory after filesystem path resolution. Subsequent functions write response JSON, metadata files, index records, and pa ...[truncated 1073 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sorftime_walmart_keyword_research.py:319

Finding

Saved-keyword mutations lack an executable authorization guard

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:116

Finding

Automatic feedback reporting can disclose user context without explicit consent

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:31

Finding

Runtime guidance installs unpinned third-party dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: return { "png_path": None, "ascii_qr": None, "error": "Missing qrcode dependency; install qrcode and pillow.", } ``` The runtime guidance instructs installation using the equivalent of: ```bash pip install qrcode pillow pip install requests ``` ### Technical Analysis The project does not provide a lockfile, exact versions, or package hashes for `requests`, `qrcode`, and `pillow`. Installing packages by unversioned name resolves whatever releases the package index serves at installation time. The names are common packages and no typosquatting indicator was identified. The risk arises from mutable dependency resolution, compromised package releases, compromised indexes or mirrors, and incompatible future versions rather than from confirmed malicious packages in this project. ### Attack Path 1. A required package is absent. 2. The user follows the runtime installation guidance. 3. `pip` resolves an unpinned package from its configured index or mirror. 4. A compromised index, account, mirror, or future release supplies unsafe installation or runtime code. 5. That code executes with the privileges of the Python environment during installation or import. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the privileges of the user or agent environment. This could expose environment variables, API credentials, files accessible to the process, and outbound network access. Exploitation requires compromise or manipulation of the de ...[truncated 93 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The POST target URL is derived from environment-controlled base URLs and then used to transmit authentication material, including login tokens and API-token generation requests. In an agent/skill environment, environment variables may be influenced by deployment or wrapper configuration, so this creates an SSRF-style exfiltration path where secrets can be sent to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The gateway request URL is also built from environment-controlled configuration and used with an Authorization header carrying the API key. If an attacker can set the base URL, they can redirect requests to a rogue server and capture the API key or trigger internal-network requests.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 78, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The script allows the destination gateway to be overridden by the LINKFOX_TOOL_GATEWAY environment variable and then sends the API key plus request payload to that URL. In an agent/runtime environment where environment variables may be influenced by configuration or another component, this creates an exfiltration risk: credentials, user query data, and session metadata can be posted to an attacker-controlled endpoint.

Content

Scanner excerpt · scripts/sorftime_walmart_keyword_research.py (reported line 85)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is Walmart keyword research, but the analyzed behavior reportedly includes SMS login, token generation, account/team info access, plan listing, order creation, payment QR generation, and payment-status queries. That is a major scope expansion into authentication, account management, and billing flows, which can expose sensitive user data and trigger financial actions outside the user's understood intent.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

Run mutation operations only after explicit authorization.

## Display Rules

1. State the selected operation and show `requestConsumed` and `costToken` when returned.
2. Preserve metric meanings and observation windows; do not turn estimates into guaranteed demand or sales.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements phone-based login, API key issuance, account inspection, and purchase onboarding, which is materially outside the declared Walmart keyword-research scope. Scope mismatch is dangerous because it expands the skill's effective privileges into account access and billing flows users would not reasonably expect from a keyword-research tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code can create orders, query payment state, and render payment QR codes, introducing commerce functionality unrelated to Walmart keyword research. In a skill ecosystem, hidden or under-declared billing capabilities are particularly risky because they can facilitate unexpected charges or social-engineered payment collection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior uses environment variables, file writes, and network access. Without a least-privilege declaration, an agent may invoke broader capabilities than users expect, increasing the risk of unintended data access, filesystem writes, or external requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation description says to use the skill when the user mentions broad concepts like "搜索量或排名筛选", "related keywords", or "product keywords". These phrases can appear in ordinary discussion about e-commerce research and the file does not provide explicit negative examples or tighter activation constraints in the trigger sentence itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs automatic reporting to a separate Feedback API based on conversation outcomes, even though that behavior is outside the core Walmart keyword-research purpose. This can transmit user prompts, reactions, or workflow details to another service without a clear need-to-know basis or explicit consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic reporting of feedback based on user expressions can disclose user-provided content, sentiments, or task context to a separate system without explicit consent. In a conversational agent context, this is dangerous because users may reveal commercially sensitive keyword strategies, account issues, or other private business information while expecting it to stay within the immediate workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 105)May include surrounding context.

| 5112 | 其他上游业务异常 | 保留返回信息并反馈 | | 5901 | 服务内部错误 | 稍后重试或反馈 |

curl 示例

bash

API_KEY="${LINKFOX_AGENT_API_KEY:-$LINKFOXAGENT_API_KEY}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The onboarding flow instructs collecting and transmitting a user's phone number to a registration script, but it does not require explicit informed consent, explain what data is sent/stored, or provide a privacy notice. In a support workflow, this creates unnecessary privacy and compliance risk because users may be nudged into sharing personal data without understanding retention, third-party handling, or safer alternatives.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L11 says to forward the configuration instructions to the user, but the file as a whole is written as a fixed Chinese operational script with no indication that language should match user preference. This effectively constrains the interaction to a specific language without opt-in or a documented locale-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The CLI writes QR code payment images into local session directories, which may persist under the workspace, home directory, or temp directory without strong controls or an explicit warning at the write point. Those files can expose payment links or order artifacts to other local processes, users, or later sessions in shared environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The login flow only accepts 11-digit phone numbers and always submits the +86 country code, and the CLI help also describes only domestic phone numbers. This imposes a specific locale/language usage constraint without opt-in or documented justification in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring promises that writing to /tmp is forbidden and that an unwritable current directory should cause an error, but the implementation silently falls back to other locations including the temp directory. This mismatch can cause sensitive API responses to be written to less trusted or unexpected locations, undermining operator assumptions and potentially exposing data to other users or processes on shared systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code performs an HTTP POST to an external gateway using the provided parameters as the request body and also includes SESSION_ID, MODE_ID, and APP_NAME in headers. Although the module docstring explains output-file behavior, it does not disclose the network transmission itself at the point of execution or via a visible user-facing prompt/log before sending.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language description hardcodes "Walmart 美国站" as the target locale/market in the activation metadata. While the skill may be intended for that market, the trigger text does not present this as a user choice or clearly frame it as a region-specific tool in the invocation condition itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes Walmart keyword research and keyword/favorites management capabilities, but L124-L132 document a separate public feedback endpoint for sending user sentiment and comments. Collecting and transmitting feedback is not an obvious requirement of keyword research itself and is presented as an additional capability beyond the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring and argparse help text are entirely in Chinese, and the script emits Chinese user-facing messages throughout. There is no indication that the user can choose another language or that the locale restriction is an intentional, documented regional requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

UNCACHEABLE_OPERATIONS includes favoriteList, suggesting that favorite-list behavior should bypass caching. But _cache_key/_load_cache are still used unless the operation check disables caching, and the manifested intent here is contradicted more specifically by the operation set itself: listing favorites is treated as uncacheable in the comment/constant name even though it is a read/list action that the rest of the script handles like other responses. This inconsistency indicates the documented/encoded intent around caching does not clearly match behavior.

Content

No source excerpt is available for this finding.