Walmart-产品分析

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.1

Overview

This Walmart analysis skill is not clearly malicious, but it should go to Review because it combines product queries with sensitive onboarding, payment, automatic feedback, and under-disclosed persistence behavior.

Install only after reviewing the LinkFox account, billing, feedback, and local-storage behavior. Use a dedicated API key, avoid sharing phone/SMS codes unless you intend to register through LinkFox, do not store keys in synced dotfiles, confirm before any paid call or payment QR flow, and disable or avoid automatic feedback submission if sensitive product research may appear in prompts or results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is derived from environment-controlled base URLs and the function sends sensitive login/session material, including access tokens and phone-based authentication data, to that destination. In a skill execution environment, an attacker who can influence environment variables can redirect these requests to an attacker-controlled host and capture credentials or API tokens.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request target is built from environment-controlled base URLs and includes the API key in the Authorization header. If the environment variable is modified, the code will send that credential and associated account/order requests to an attacker-controlled server, enabling credential theft and abuse of the linked account.

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in headers, including SESSION_ID, MODE_ID, APP_NAME, and an authorization key, and the destination host is also overridable through LINKFOX_TOOL_GATEWAY. This creates a real exfiltration risk because an attacker who can influence the environment can redirect requests to an arbitrary server and cause credential and session metadata leakage.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly uses environment variables, writes response data to disk, and invokes a networked API, but no declared permissions are presented to constrain or inform those capabilities. This creates a transparency and governance gap: operators and users cannot readily assess that the skill will access credentials, transmit data externally, and persist data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The skill is described as a Walmart product-analysis integration, but the referenced onboarding/payment flow indicates materially broader behavior including account login, API-key generation, user/team info retrieval, subscription browsing, order creation, payment initiation, QR code generation, and payment-status polling. That mismatch can mislead users and reviewers about the true trust boundary and may expose sensitive account, billing, and identity data through a skill not expected to handle them.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The file documents a separate external feedback submission API that is unrelated to Walmart product analysis, expanding the skill's effective capability beyond its stated purpose. In agent settings, this can enable unintended outbound data transmission to a third-party endpoint, including user prompts, tool outputs, identifiers, or other sensitive context if an agent treats the documentation as approved functionality.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This skill file implements account onboarding, SMS login, API key acquisition, package listing, order placement, and payment QR generation, which is unrelated to the declared Walmart product-analysis purpose. Such scope divergence is dangerous because it can trick users or hosts into supplying phone numbers, verification codes, and payment actions under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code creates orders and generates payment QR codes despite the skill being described as a Walmart product-analysis tool. Embedding billing capability in an unrelated skill increases the risk of unauthorized charges, social engineering, and deceptive monetization within a context where users would not expect payment processing.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file performs SMS verification, account login, user/team discovery, and API token generation, far beyond the declared product-analysis scope. This broad access workflow can harvest user credentials and mint long-lived API keys, making the mismatch especially dangerous in an agent skill context.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is presented as a product-analysis/query skill, but it persistently writes full API responses plus session metadata to local storage. That behavior expands the data-handling scope beyond a transient lookup tool and can retain potentially sensitive commercial data, identifiers, or user context longer than expected.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The module docstring explicitly states that writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation silently falls back to the home directory and then the temporary directory. This mismatch is security-relevant because operators and upstream agents may rely on the documented storage restrictions, while the code actually writes sensitive output to broader or less secure locations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs automatic feedback reporting when behavior mismatches intent or when the user expresses satisfaction/dissatisfaction, but it does not clearly warn that user interaction content may be transmitted to an external Feedback API. This can result in unanticipated sharing of conversational content, business queries, and possibly identifiers without meaningful user awareness or consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The onboarding flow instructs the operator to collect and transmit a user's phone number to an external registration script without any privacy notice, consent guidance, or data-handling warning. This creates a real privacy and compliance risk because personally identifiable information is being processed through a tool-controlled workflow with unclear retention, sharing, and security properties.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions tell users to persist an API key into shell startup files or environment variables without warning that the key is a sensitive credential. Storing secrets this way can expose them to other local users, shell history leakage, accidental disclosure during debugging, or inclusion in backups and dotfile sync systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The login command emits the freshly obtained API key directly to stdout JSON, which may be captured by logs, agent transcripts, shell history, or calling frameworks. In hosted agent environments, stdout is often persisted or observable by other components, turning a valid credential into an easy exfiltration target.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script always saves the full API response to disk, regardless of content sensitivity and without explicit user confirmation. In a skill that handles external service results, this can expose returned business data, identifiers, and session-correlated artifacts to unintended local readers or later processes.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Automatic reporting of behavioral mismatches, praise, dissatisfaction, or inferred improvement opportunities creates a semantic exfiltration path from the conversation to an external service. Because the trigger is broad and content-based, the system may transmit sensitive business intent, product research interests, or user sentiments beyond what is necessary to fulfill the Walmart analysis request.

Static analysis

No suspicious patterns detected.