西柚-关键词洞察

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:44 PM UTC
• Version: 0.0.8

Overview

The skill largely performs the advertised Xiyou Amazon analytics, but it also has automatic external feedback reporting, durable local response storage, and account/billing helper flows that deserve user review before installation.

Install only if you trust LinkFox and Xiyou with the queried ASIN/keyword data and required credentials. Use per-session environment variables where possible, verify no LINKFOX_* endpoint overrides point to untrusted hosts, avoid shared workspaces because full responses are saved locally, and treat the automatic feedback reporting as a privacy concern unless the publisher adds explicit consent or disable controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The URL used by requests.post is derived from environment-controlled base URLs such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL. If an attacker can influence the runtime environment, they can redirect SMS login, access tokens, refresh tokens, and API-token generation traffic to an attacker-controlled endpoint, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The urllib request target is built from environment-controlled gateway base URLs before sending authenticated requests with the LinkFox API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can force the CLI to send API keys and billing/order data to a malicious server, enabling credential theft and fraudulent operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest presents the skill as a Xiyou analytics client, but the documented behavior expands into LinkFox account login, SMS verification, API key generation, account-center access, plan purchase, payment order creation, QR rendering, and order-status polling. This hidden scope expansion creates a confused-deputy risk: a user invoking analytics may unknowingly trigger identity, billing, or account-management flows with very different sensitivity and abuse potential.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill claims to perform Xiyou ASIN/keyword analytics, but it also instructs automatic reporting to a separate Feedback API. Sending interaction-derived content to another service outside the core analytics purpose is a secondary data use that users may not expect, especially if comments, intent, or dissatisfaction are transmitted automatically.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The document adds a separate public feedback-posting API that is unrelated to the skill’s stated ASIN/keyword analysis function. This expands the skill’s capability surface to perform outbound writes to a third-party endpoint, which can enable unintended data exfiltration of user content, conversation summaries, or operational metadata if invoked without explicit user intent and consent.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper writes full API responses to persistent local storage under a session directory, even though responses may contain sensitive business data and echoed authentication-related fields. This increases exposure through local compromise, accidental sharing, backup leakage, or later cross-session access without any minimization or explicit consent at the call site.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code creates cross-call session/index storage in shared filesystem locations unrelated to making a single Xiyou query. That broader statefulness can expose usage metadata across runs and users, creating privacy and information-disclosure risk if the host is shared or artifacts are collected.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation rule is overly broad and allows the skill to trigger even when the user does not explicitly mention the skill or a unique trigger term. In context, that is risky because the skill can make external requests, use stored credentials, incur paid usage, and persist responses to disk, all from a loosely matched intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that full API responses are always written to disk under the working directory, but it does not prominently warn users about persistence, retention, or possible exposure to other local tools and collaborators. Since responses may include commercially sensitive ASIN/keyword research, account-related metadata, or usage details, silent persistence increases privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation states that clientId and clientSecret are automatically injected into requests and transmitted upstream, but it does not warn about the sensitivity of these credentials or the trust boundary between the agent, LinkFox gateway, and the upstream Xiyou service. In an agent setting, silent credential forwarding increases the risk of accidental secret exposure, misuse across endpoints, and user misunderstanding about what sensitive data is being sent to third parties.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The onboarding flow explicitly asks the user to provide a phone number and then uses it for registration/login via a local script, but it does not include any privacy notice, consent language, retention policy, or warning about how that data will be handled. In a support/onboarding context this creates avoidable privacy and compliance risk because users may disclose sensitive personal data to the agent or host environment without understanding where it is sent or stored.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill tells users to run commands that permanently modify shell startup files or Windows environment settings so the API key is automatically loaded in future sessions, but it does not clearly warn that these are persistent system changes. This can cause unintentional credential exposure, surprise configuration drift, or leakage to other processes/users on shared systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The helper persists full API responses locally without a clear warning, so operators may unknowingly create durable copies of potentially sensitive commercial data. Hidden persistence increases the chance of unintended disclosure through local access, logs, sync tools, or support bundles.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Automatically reporting user feedback to an external API can transmit user-provided content, sentiment, or workflow details without explicit consent. In a skill that already handles external requests and potentially sensitive commercial research, this creates an avoidable data-sharing channel and may violate user expectations or internal privacy policies.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.