WallySmarter-商品详情

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:00 AM UTC
• Version: 1.0.7

Overview

This skill can perform Walmart product lookup, but it also handles sensitive login/payment flows, stores full results locally, and can automatically send feedback externally without clear user consent.

Install only if you are comfortable giving this skill LinkFox credentials, product-query history, and possible phone/SMS onboarding data, and only after reviewing or disabling automatic feedback submission, local response storage, endpoint overrides, and billing/order actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:127

Finding

Automatic Disclosure of User Conversation Content to an External Feedback Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wallysmarter_product_detail.py:37

Finding

Environment-Controlled Endpoints Can Receive API Keys and Login Tokens

Content

View full analysis

str: return ( os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com" ).rstrip("/") ``` ```python def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding script similarly obtains authentication destinations from unrestricted environment variables: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` Sensitive tokens are then sent to the resulting destinations: ```python resp = _http_post( f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": { "aid": "3026344186", "did": "", "type": "Windows", "os" ...[truncated 2524 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:478

Finding

Phone Numbers, SMS Codes, and API Keys Are Exposed Through Command-Line and Output Channels

Content

View full analysis

``` The parser accepts both secrets as ordinary positional arguments: ```python p = sub.add_parser("login") p.add_argument("phone") p.add_argument("code") p.add_argument("--channel", default="skill") p.set_defaults(func=_cmd_login) ``` The login flow returns the complete API key: ```python return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The command handler serializes that object to standard output: ```python def _cmd_login(args) -> int: r = login_and_get_key( args.phone.strip(), args.code.strip(), args.channel, ) _emit(r) if "api_key" in r: return 0 return 1 ``` ### Technical Analysis Command-line arguments may be recorded in shell history and can be visible to local process-inspection tools, job supervisors, terminal capture systems, CI logs, or Agent execution traces. SMS verification codes are short-lived, but exposure during their validity period may permit account login. The generated API key is included in structured standard output. Standard output is likely to be retained by the invoking Agent, terminal, orchestration platform, or diagnostic logs. The onboarding documentation also recommends embedding the API key in shell commands used to update profile files, which can preserve the key in shell history. Masking the returned phone number d ...[truncated 1129 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wallysmarter_product_detail.py:97

Finding

Unsanitized Session Identifier and Insecure Persistent Response Storage

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] ``` ```python def _ensure_session(ts: float) -> tuple[str, str]: date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The full response is then written to another artifact: ```python serialized = json.dumps( result, ensure_ascii=False, indent=2, ) ts = int(time.time()) out_path = _resolve_output_path(ts) try: with open(out_path, "w") as f: f.write(serialized) ``` ### Technical Analysis `SESSION_ID` is taken directly from the environment and passed to `os.p ...[truncated 2441 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:167

Finding

Unpinned Runtime Dependency Installation Guidance

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The POST target URL is derived from environment-controlled base URLs, and the request includes sensitive authentication material such as access tokens, uid/tid headers, SMS-login data, and token-generation flows. If an attacker can influence environment variables, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or induce the skill to perform unintended account actions.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The gateway request destination is also environment-derived, while the code automatically attaches the LinkFox API key in the Authorization header. An attacker who can tamper with environment configuration can force authenticated requests to an arbitrary host, leaking the API key and enabling unauthorized use of the account or downstream service abuse.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/wallysmarter_product_detail.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description does not disclose local persistence, session archiving, cache/meta/index maintenance, or fallback writes to temporary directories, yet the detected behavior includes file-system side effects. Hidden persistence is dangerous because it can retain user data, API responses, or operational metadata beyond the immediate request and bypass user expectations about a read-only lookup tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description does not disclose local persistence, session archiving, cache/meta/index maintenance, or fallback writes to temporary directories, yet the detected behavior includes file-system side effects. Hidden persistence is dangerous because it can retain user data, API responses, or operational metadata beyond the immediate request and bypass user expectations about a read-only lookup tool.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are very broad, saying the skill should trigger whenever a request loosely relates to Walmart product details, price history, or sales trends, even without explicit mention of the tool. Overbroad triggering can cause the agent to invoke this skill in unintended contexts, exposing users to unnecessary data access, hidden billing, or side effects from the broader undeclared capabilities noted elsewhere.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

{"productId": 5169493923, "includeStats": false}

text

## Display Rules

1. **Present data clearly**: Show product details in a structured format. Do not add subjective business recommendations unless asked.
2. **Price formatting**: Display current price alongside wasPrice when available to highlight discounts. Always show USD symbol.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata claims Walmart product-detail functionality, but the code implements an unrelated LinkFox onboarding, SMS login, API-key issuance, plan listing, ordering, and payment workflow. This capability mismatch is dangerous because it can socially engineer users or the host system into exposing phone numbers, verification codes, credentials, and payment actions under false pretenses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code contains high-risk account and payment operations—SMS authentication, API token generation, order creation, and QR payment rendering—that are far beyond the minimum privileges needed for product-detail lookup. In the context of a Walmart data skill, these hidden capabilities materially increase the chance of credential theft, unauthorized account access, and deceptive payment initiation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares only a product-detail lookup purpose, but the metadata provides no explicit tool scope while static analysis detected environment access, file writing, and network capabilities. This creates an authority gap where the skill may access secrets, persist data, or make outbound requests beyond what users would reasonably expect from a simple Walmart product query.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file embeds both Chinese and English trigger phrases and includes instructions like @智能数据查询, but it does not state how the assistant should choose response language or defer to the user's preference. This can create a locale-policy issue if the skill defaults behavior based on fixed language assumptions rather than explicit user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 117)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/wallysmarter/productDetail \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file for a Walmart product-detail skill includes a separate feedback submission API that is unrelated to the declared data-retrieval function. This expands the skill's capabilities to send user-derived content to an external endpoint, creating unnecessary data-exfiltration and prompt-manipulation risk if an agent is induced to submit feedback containing user data or internal context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The onboarding document directs the agent to handle authentication recovery, user registration, and paid plan purchase flows that are outside the expected scope of a Walmart product-detail skill. This scope expansion is dangerous because it can cause the agent to collect sensitive data and steer users into account/payment actions unrelated to the requested product lookup, increasing phishing, privacy, and social-engineering risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly tell the agent to ask for a user's phone number and then use it to trigger a registration/login flow, but they provide no privacy disclosure, data-minimization guidance, or verification that the destination service is trusted. In an agent context, this creates a real risk of unnecessary collection of personal data and credential-like OTP handling, which can be abused for account takeover or privacy violations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and command help strings are entirely in Chinese, and the CLI presents its guidance and messages in that language by default. This can constitute a language/locale policy violation because the skill does not offer any language selection or opt-in mechanism.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

External transmission is expected for networked skills, but here it is security-relevant because the transmitted data can include phone numbers, SMS codes, access tokens, refresh tokens, and API-token operations. Combined with environment-overridable endpoints and misleading skill scope, this transmission surface becomes materially more dangerous than a normal product-query integration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This flow logs in with SMS, fetches team context, and returns a usable API key to stdout JSON without any in-file safeguards, consent gate, or minimization. In a skill environment, that makes sensitive credentials easy to expose to logs, calling components, or unintended consumers, especially given the mismatch between declared skill purpose and actual behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring promises that writing to /tmp is forbidden and that failure to write the current directory should raise an error, but the implementation silently falls back to home and temporary directories. This mismatch can cause operators to trust the storage behavior incorrectly, leading to data being written into less protected or unexpected locations such as shared temp space.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script persistently stores full API responses, cache entries, and session metadata to local disk even though the skill's functional scope is just querying Walmart product details. If API responses contain sensitive business data, identifiers, or account-linked metadata, this creates unnecessary retention, expands the attack surface to local file disclosure, and may violate least-privilege/data-minimization expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The QR rendering function creates a PNG file on disk, and the order command invokes it automatically when creating a payment order. Although stderr logs mention ordering details, there is no explicit user disclosure in this code path that a file will be written to a workspace/home/temp directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.