沃尔玛-商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.6

Overview

The skill does perform Walmart search, but it also adds sensitive LinkFox onboarding, billing, payment, credential, and automatic feedback flows that need user review before installation.

Install only if you are comfortable with a paid LinkFox-backed skill that may ask for a phone number and SMS code, generate and print an API key, create payment orders, write result/cache files locally, and send feedback content to LinkFox. Avoid entering sensitive prompts if automatic feedback is enabled, verify endpoint environment variables before use, and treat generated API keys as secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used to send login data, SMS requests, tokens, and other sensitive values over the network. In a hostile or misconfigured runtime, an attacker can redirect these requests to an attacker-controlled endpoint and capture phone numbers, verification codes, access tokens, refresh tokens, and generated API keys.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and used with an Authorization header containing the LinkFox API key. If the environment variable is modified, the CLI will send authenticated requests and billing/order data to an attacker-controlled server, leaking credentials and potentially enabling account abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill documentation indicates access to environment variables, file writing, and networked side effects, yet it declares no permissions or user-facing disclosure for those capabilities. In this context, those capabilities are not necessary for a simple Walmart listing search alone and become risky because the same skill also includes onboarding, billing, and feedback flows that can transmit data and persist artifacts without clear consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is Walmart product search, but the skill text references unrelated account, authentication, API key generation, user/team lookup, subscription purchase, payment QR generation, and payment-status polling behaviors. That mismatch is dangerous because it can socially engineer users into providing phone numbers, verification codes, or payment approval in a context where they expected only product search, greatly expanding the attack surface and enabling unauthorized billing or credential handling.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documentation adds a separate feedback-reporting API that is outside the core Walmart product search purpose of the skill. This expands the skill's effective capability to transmit data to another external endpoint, creating a covert or unnecessary data egress path that could be used to send user content without clear need or consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A feedback submission mechanism is context-inappropriate for a Walmart search skill because users would reasonably expect product retrieval, not outbound reporting. That mismatch increases the chance that conversational content, intent details, or operational metadata could be exfiltrated to a third party under the guise of normal tool usage.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements LinkFox account onboarding, SMS-based login, API-key retrieval, package browsing, order creation, and payment QR generation, which is unrelated to the declared Walmart product search skill. Such capability mismatch is dangerous because it expands the skill into credential handling and monetization flows that users would not reasonably expect from a Walmart listing/search tool.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill contains end-to-end SMS login and API-token issuance logic, including access token handling, user/team lookup, and API key generation. In the context of a Walmart search skill, this is highly suspicious because it can harvest one-time codes and mint reusable credentials unrelated to the advertised function.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code implements package listing, order creation, payment-status querying, and QR-code payment rendering, none of which are necessary for Walmart product search. This introduces financial transaction capability into an unrelated skill, increasing the risk of unauthorized purchases, phishing-like payment prompts, and abuse of user trust.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The module docstring promises that output will not be written to /tmp and that failure should occur if the current directory is not writable, but the implementation silently falls back to other locations including the user's home directory and the system temp directory. This can cause sensitive Walmart query results and session metadata to be persisted in less controlled locations than operators expect, increasing exposure and violating security assumptions.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill instructs use of an Authorization header sourced from environment variables for an external service, but provides no user-facing disclosure that credentials are being sent off-platform. While using API keys is normal, the lack of transparency and boundary clarification can lead to unsafe secret handling and unintended trust in a third-party endpoint.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The feedback API explicitly instructs sending free-form content describing what the user said or intended to an external endpoint, yet includes no privacy warning, consent mechanism, or redaction guidance. This is dangerous because user prompts may contain sensitive business data, personal data, or internal context that would be disclosed to a third party unnecessarily.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding flow explicitly asks for a user's phone number and then uses it to send a verification code and perform login/registration, but the document provides no privacy notice, consent language, retention limits, or disclosure about where that personal data is transmitted. In a support/onboarding context this increases the risk of collecting sensitive personal data without informed consent or adequate handling safeguards.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The login command emits the generated API key directly to stdout JSON, which can be captured by logs, calling processes, shell history wrappers, or downstream tooling. Because this key appears to grant API access, exposing it in routine command output materially increases the chance of credential leakage and reuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: This code performs external transmission of sensitive onboarding and authentication data. External transmission alone is expected for networked functionality, but here it becomes security-relevant because the transmitted data includes phone numbers, OTPs, and tokens and the destination can be environment-influenced.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.