Tsearch-网页实时搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.6

Overview

This is a real web-search skill, but it also handles phone-code login, API-key issuance, payments, automatic feedback reporting, and local result storage in ways users should review carefully before installing.

Install only if you are comfortable with LinkFox receiving search queries, session/app metadata, feedback content, phone-based onboarding data, and payment-related requests. Prefer obtaining API keys and completing payments directly on LinkFox's official site rather than giving OTPs or payment choices through an agent, and review where the script stores cached search results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The code builds destination URLs from environment-controlled base URLs and then sends sensitive authentication material, including SMS login data, access tokens, refresh tokens, and generated API keys, to those endpoints via requests.post. If an attacker can influence environment variables in the hosting context, they can redirect traffic to attacker-controlled servers and exfiltrate credentials or force the tool to interact with unintended internal services.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL is derived from environment variables and used in urllib.request.urlopen with the bearer API key attached in the Authorization header. In a hostile or misconfigured runtime, this enables server-side request forgery and credential exfiltration by redirecting authenticated requests to attacker-chosen or internal network destinations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises only web search, but the content references environment-variable use, onboarding flows, external API interaction, and file writes via referenced docs, indicating capabilities beyond a minimal search skill without any declared permissions. Undeclared capabilities reduce transparency and make it harder for reviewers or users to understand what sensitive resources the skill may access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is web search, but the skill also includes instructions to handle authentication, API key retrieval, account/team information, subscription plans, order creation, payment QR generation, and payment status queries. This is a significant description-behavior mismatch that can mislead operators into approving a search tool that also facilitates account and billing workflows involving sensitive user data and financial actions.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The onboarding document adds account recovery, registration, and billing/payment workflows to a skill whose declared purpose is web search. This expands the agent's effective authority into identity and financial operations, creating unnecessary attack surface and making it easier to socially engineer users into sharing credentials, phone numbers, or paying for unrelated services.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to collect a user's phone number and one-time verification code and then perform login/registration actions on the user's behalf. For a web-search skill, this is unjustified access to sensitive authentication factors and could enable account takeover, impersonation, or unauthorized linking of user identity to the service.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documented ability to list plans, create payment orders, and query payment status gives a search skill access to billing workflows unrelated to its stated function. This can be abused to steer users into purchases, generate fraudulent or confusing payment requests, or expose financial metadata without a clear need.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS login, API key issuance, package listing, order creation, and payment QR generation, which is materially unrelated to the declared web-search skill. Such capability mismatch is dangerous because it expands the skill into credential collection and monetization workflows that users and reviewers would not expect from a search tool.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code includes package retrieval, order creation, payment initiation, and order-status queries despite the skill being described as a network search utility. In this context, hidden commerce and subscription operations are especially risky because they can drive unauthorized purchases or social-engineer users into funding accounts under the guise of using search.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file performs SMS-based authentication, token exchange, team discovery, and API key generation, all unrelated to the advertised search behavior. This is dangerous because it collects phone numbers and one-time codes, then converts them into long-lived credentials, creating a strong phishing and account-takeover risk within an unexpected skill surface.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring promises it will never write to `/tmp` and will error if the current directory is not writable, but the implementation falls back to `~/linkfox/` and then the temp directory. That mismatch can silently persist potentially sensitive search results in locations the caller did not expect, increasing confidentiality and compliance risk.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The activation criteria are extremely broad, including nearly any request to 'find out,' 'research,' verify facts, or obtain current information, even when the user does not explicitly ask to search. Overbroad triggering can cause unnecessary external data access, accidental invocation costs, privacy leakage in search queries, and routing away from safer or more appropriate tools.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The Feedback API explicitly instructs clients to include what the user said or intended in a request to an external service, but the documentation provides no warning, consent requirement, or minimization guidance. This creates a real privacy and data-handling risk because user prompts, intent, or other sensitive context may be transmitted off-platform without the operator or user understanding that disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document tells the agent to request and process a user's phone number and verification code but provides no privacy warning, consent language, or handling constraints. Collecting these highly sensitive values through the agent increases the risk of disclosure, retention, phishing, and misuse.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script sends arbitrary user-supplied search parameters along with `SESSION_ID`, `MODE_ID`, and `APP_NAME` to a remote service without any runtime notice or consent boundary. In this skill context, external transmission is expected, but undisclosed metadata sharing can still leak contextual or operational information beyond the user’s query.

Static analysis

No suspicious patterns detected.