Walmart-产品分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.1

Overview

This skill provides the advertised Walmart product analysis, but it also handles account, credential, payment, telemetry, and local-storage flows with safety and scoping issues that deserve review before installation.

Review this skill carefully before installing. Use it only in an environment where LinkFox endpoint variables cannot be altered by untrusted parties, avoid running onboarding in shared logs or transcripts unless secrets are redacted, and treat generated API keys, payment QR files, cached responses, and saved product-analysis data as sensitive. Consider disabling or requiring confirmation for feedback reporting and prefer a separate, explicit account/billing workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sorftime_walmart_product_analysis.py:256

Finding

Path Traversal Through Unvalidated SESSION_ID Enables Writes Outside the Intended Output Directory

Content

View full analysis

str: """优先 env SESSION_ID；缺省按 HHMMSS-<6 hex> 生成（同一进程内稳定）。""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """返回 (linkfox_root, session_dir)；session_dir 一定存在。""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The resulting path is later used for response output: ```python def resolve_data_path(slug: str, ts: float, ext: str = "json") -> str: """普通 skill 的原始数据落到 /data/-.。""" _, session_dir = _ensure_session(ts) sub = os.path.join(session_dir, "data") os.makedirs(sub, exist_ok=True) out = os.path.join(sub, f"{slug}-{int(ts * 1_000_000)}.{ext}") _update_meta(session_dir, skill=slug, kind="data", file_rel=os.path.relpath(out, session_dir), ts=ts) return out def _resolve_output_path(ts): """落到 /linkfox/<日期>//data/-.json，按 SESSION_ID 聚合到同一会话。""" sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return resolve_data_path(SLUG, ts) ``` From `scripts/onboarding.py`: ```python def session_dir() -> str: ts = time.time() sid = (os ...[truncated 2625 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:478

Finding

API Credential Is Returned in Plaintext Through Standard Output

Content

View full analysis

dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: 手机号格式不正确: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: 验证码格式不正确: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}（不影响拿 key）", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token(lg["access_token"], lg["user_id"], info["group_id"]) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` ### Technical Analysis The API token returned by `_get_or_generate_api_token` is inserted into the command result under `api_key`. `_cmd_login` then serializes the c ...[truncated 1235 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:68

Finding

Environment-Controlled API Endpoints Can Receive Authentication Tokens and Personal Information

Content

View full analysis

str: """网关基础地址：env LINKFOX_TOOL_GATEWAY 优先，缺省回退正式地址。""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=120) as response: return json.loads(response.read().decode("utf-8")) ``` From `scripts/onboarding.py`: ```python def _env_base(name: str, default: str, *fallbacks: str) -> str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: """通用 requests POST，返回 JSON 或 {_error, _body}。""" try: _re ...[truncated 3494 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:98

Finding

Automatic Feedback Reporting Can Transmit User Interaction Data Without Explicit Consent

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:171

Finding

Onboarding Recommends Installation of Unpinned Runtime Dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis When required libraries are absent, the script tells the user to install `qrcode`, `pillow`, and `requests` without exact versions, hashes, a lock file, or a trusted package-index requirement. The script does not automatically execute `pip`; exploitation therefore depends on a user following the recommendation. Unrestricted package installation produces non-reproducible environments and exposes users to future compromised releases, malicious package-index configuration, dependency substitution, and incompatible updates. ### Attack Path 1. The onboarding script runs in an environment lacking one of the optional dependencies. 2. The script displays an unrestricted `pip install` recommendation. 3. The user runs the suggested command. 4. `pip` resolves the latest available packages from the configured index and executes installation-time package behavior. 5. If a selected package, transitive dependency, or configured index is compromised, attacker-controlled code executes with the privileges of the installing user. ### Impact Assessment A compromised dependency can execute code during installation or later import with the user's privileges, allowing access to local files, environment variables, API credentials, and network resources. The current project does not demonstrate that the named packag ...[truncated 94 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The script builds request destinations from environment variables and then sends authentication material, including access tokens or API keys, to those URLs. If an attacker can influence the environment, they can redirect login and token-generation traffic to an attacker-controlled host and capture credentials, making this an SSRF-style credential exfiltration risk.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses a base URL derived from environment variables and attaches the API key in the Authorization header before calling urlopen. An attacker who controls the runtime environment can point the gateway to a malicious server and steal the API key or force requests to unintended internal/external services.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/sorftime_walmart_product_analysis.py (reported line 84)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose is Walmart product analysis, but the behavior reportedly extends into login, API-key generation, account/team access, package listing, payment order creation, QR-code generation, and payment-status polling. This capability expansion is dangerous because users and calling systems may authorize the skill for market-data lookup while it actually performs account and billing operations with access to sensitive identity and payment flows.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

python scripts/sorftime_walmart_product_analysis.py '{"operation":"salesVolume","productId":"5169493923","queryDate":"2026-07-01","queryEndDate":"2026-07-31","pageIndex":1}'

text

## Display Rules

1. State the operation and supplied product name or product ID, and show returned `requestConsumed` and `costToken`.
2. For `searchByName`, label results as related products rather than exact matches and report the requested page.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements SMS login, API key retrieval, account inspection, subscription listing, ordering, and payment QR generation, which are materially unrelated to a Walmart product-analysis skill. This mismatch is dangerous because it expands the skill into credential collection and monetization workflows that users would not reasonably expect from the declared functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code contains direct purchase and payment workflow logic, including plan discovery, order creation, and QR code payment rendering, without justification from the stated Walmart analysis use case. Embedding billing capabilities in an unrelated skill increases the chance of deceptive monetization, unauthorized charges, or user coercion into purchasing services they did not intend to access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope or permissions despite documented use of environment variables, file writes, and network access. Without a least-privilege declaration, an agent may grant broader capabilities than necessary, increasing the chance of unintended data access or side effects.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates persistent logging of full API responses into session-linked local files under the working directory. This can retain user inputs, product queries, identifiers, pricing data, account-related metadata, or other sensitive content longer than necessary, increasing exposure to later unauthorized access, cross-task leakage, or accidental inclusion in model context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Automatic Feedback API reporting is unrelated to the core Walmart-analysis function and can create undisclosed outbound data flows containing user prompts, results, or behavioral signals. Extra telemetry paths widen the data-sharing surface and can leak context without the user's informed consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to auto-report feedback based on user reactions or intent mismatches can transmit interaction details without explicit user approval. Because user sentiment and troubleshooting context often contain sensitive business information, this creates a privacy and data-governance risk beyond the skill's stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The API reference explicitly instructs forwarding authentication and session-related headers but provides no privacy, retention, or redaction guidance. In agent environments, this increases the risk that sensitive API keys or session identifiers are unnecessarily propagated, logged, or exposed to downstream services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 103)May include surrounding context.

| 5112 | 其他上游业务异常 | 保留返回信息并反馈 | | 5901 | 服务内部错误 | 稍后重试或反馈 |

curl 示例

bash

API_KEY="${LINKFOX_AGENT_API_KEY:-$LINKFOXAGENT_API_KEY}"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation introduces a separate feedback submission API unrelated to the stated Walmart product analysis function. In an agent skill context, an extra endpoint can create an unexpected data egress path where user prompts, results, or identifiers may be transmitted outside the primary business flow without clear necessity or consent boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The onboarding instructions trigger on broad substring matches such as 'unauthorized', 'quota', or 'insufficient', which can appear in unrelated tool failures or other skills' errors. This can cause the agent to invoke registration, login, or payment flows outside the intended context, potentially leading to unnecessary collection of phone numbers, exposure of auth state, or unsolicited purchase prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module description and user-facing help/messages are presented exclusively in Chinese, and the phone handling is explicitly limited to domestic numbers with +86 assumptions. This enforces a specific language/locale experience without opt-in or an explicit note that the tool is region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The login command emits a freshly obtained API key to stdout as JSON, which can be captured by calling agents, logs, shell history, CI systems, or other observers. Because this is a long-lived secret enabling API access, exposing it through standard output materially increases the risk of credential leakage and account compromise.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation explicitly says outputs are always written under the current working directory and '/tmp' is forbidden, but the implementation can silently fall back to '~/linkfox' or a temporary directory. That mismatch can cause sensitive Walmart API responses to be stored in locations the user did not expect, weakening data-handling guarantees and potentially exposing data to other local users, backup systems, or less protected temp storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill always persists full API responses to disk and also caches responses locally, while only mentioning this in comments and docstrings rather than giving a clear runtime warning or requiring user consent. Because product-analysis responses may contain commercial intelligence, identifiers, query history, or account-scoped data, unconditional persistence increases the risk of local data exposure, unintended retention, and leakage through shared workspaces or backups.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The _resolve_output_path docstring claims data is written to '/linkfox///data/...', but actual resolution delegates to _linkfox_root(), which may choose ACPX_WORKSPACES, the home directory, or the system temp directory. This inconsistency is dangerous because downstream users and calling agents may rely on the documented path semantics for containment, cleanup, and privacy decisions, but the data may end up elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description is written in Chinese while other user-facing instructions in the file are in English, and the skill does not state that language will be chosen based on user preference. This can impose a language/locale behavior without explicit opt-in, which matches the policy concern for forced language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Important user-facing sections such as invocation method, output behavior, and authentication guidance are presented in Chinese only, while the rest of the document is bilingual or English. Without stating that the skill adapts to the user's language preference, this creates an implicit language constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The QR rendering logic creates PNG files on the local filesystem, and the order command invokes it automatically. While there is logging for order creation, there is no user disclosure in this file that local files will be created under a session directory, which can matter for privacy and filesystem hygiene.

Content

No source excerpt is available for this finding.