WallySmarter-商品详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.7

Overview

The skill can look up Walmart product data, but it also includes account signup, SMS-code login, API-key generation, payment ordering, feedback reporting, and local data persistence that deserve review before installation.

Install only if you are comfortable with LinkFox/WallySmarter receiving API requests and with the skill handling LinkFox account setup, phone-based SMS login, paid plan purchase steps, local response caching, and API-key output. Prefer using the official LinkFox site directly for signup, payment, and key management, and review any environment variables that can redirect LinkFox endpoints before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends authentication material, SMS-login data, and token-management traffic to those endpoints via requests.post. If an attacker can influence environment variables in the skill runtime, they can redirect sensitive data to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway helper constructs urllib requests using a base URL sourced from environment variables and attaches the API key in the Authorization header. An attacker who controls the environment can redirect these calls to a malicious server and capture the API key and subsequent account/order operations.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request sent via urlopen includes sensitive environment-derived values in headers, including the API key and session metadata, and the destination host is partly controlled by the LINKFOX_TOOL_GATEWAY environment variable. In a hostile or misconfigured runtime, this can redirect credentials and session identifiers to an attacker-controlled endpoint, turning a normal API call into exfiltration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill appears to rely on environment variables, file writes, and network access without declaring those capabilities, which breaks least-privilege expectations and prevents proper review of what the skill can do. In this context, the same undeclared capabilities could be used to access secrets, persist data, or make external requests beyond a simple product lookup, especially since the document also references onboarding and payment-related flows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: a product-detail skill also includes account onboarding, SMS login, API key generation, account/team queries, plan listing, order creation, payment QR generation, and payment-status checks. Users and reviewers may authorize or trigger the skill expecting low-risk catalog retrieval, while it can instead drive authentication and billing workflows involving sensitive data and financial actions.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file for a Walmart product-detail lookup skill contains onboarding instructions for authentication recovery, phone-based registration, and billing/payment flows that are unrelated to the stated skill purpose. This expands the skill into account provisioning and monetization handling, increasing phishing, social-engineering, and unauthorized data-collection risk in a context where users expect only product data lookup.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill directs the agent to collect a user's phone number, send verification codes, log in on the user's behalf, and assist with paid plan purchase, none of which is justified by a product-detail lookup feature. In this context, the behavior can be abused to harvest personal data, facilitate account takeovers, or pressure users into purchases under the guise of a benign retail-data query.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements LinkFox account onboarding, SMS login, API-key retrieval, package listing, and ordering flows, which are unrelated to the declared Walmart product-detail skill. This mismatch strongly suggests the skill is acting as a credential/payment collection mechanism under a misleading description, increasing the chance of unauthorized data access and social engineering.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section creates orders, queries payment state, and renders payment QR codes despite the skill claiming to provide Walmart product details. Embedding billing capabilities in an unrelated skill can be used to induce users to make payments or subscribe to services they did not intend to access.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code performs SMS-based authentication, token exchange, user/team discovery, and API-token generation, all unrelated to Walmart analytics. In context, that means the skill can solicit a phone number and verification code to mint reusable credentials for another platform, which is a serious credential-harvesting risk.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module documentation explicitly states it is a LinkFox account/environment onboarding CLI, directly contradicting the skill metadata claiming Walmart product-detail functionality. This discrepancy is a strong indicator of deceptive packaging designed to bypass review or trick users into providing credentials and payments.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The docstring says the skill forbids writing to /tmp and errors if the current directory is not writable, but the implementation silently falls back to home and temp directories. This mismatch can cause users or orchestrators to make unsafe assumptions about where potentially sensitive API responses are stored, leading to unintended data exposure and weaker containment guarantees.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill creates persistent per-session metadata and an index across runs, which exceeds the narrow purpose of fetching a single product detail. This broadens data retention and correlation, enabling accumulation of user/session activity over time that may reveal usage patterns or task history beyond what is necessary for the skill.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The skill caches and stores full API responses on local disk even though it is presented as a lookup/query tool. While this is not inherently malicious, it increases the local data footprint and may retain product or account-related response data longer than users expect.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The auto-trigger condition is overly broad and allows invocation for almost any request about a single Walmart product, even when the user did not explicitly ask for this skill. Broad triggers increase the chance of unintended execution, which is more dangerous here because the skill text also references billing and onboarding behaviors that exceed simple product lookup.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation tells the agent to ask for and use a user's phone number for scripted registration, but provides no privacy notice, retention limits, or consent language. Collecting personal contact data in a skill that appears to be for Walmart product details creates unnecessary privacy exposure and makes users more vulnerable to impersonation or misuse of their information.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The login flow emits a raw API key to stdout JSON, which may be captured by logs, orchestration systems, transcripts, or downstream tools. Exposing long-lived credentials through standard output materially increases the risk of accidental disclosure and reuse by unauthorized parties.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script always writes the full response to disk and does so without an execution-time warning or user confirmation. In this skill context, API responses may include business data and session-linked information, so silent persistence increases the chance of unintentional retention or disclosure on shared systems.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.