Back to skill

Security audit

智慧芽-专利全文附图获取

Security checks across malware telemetry and agentic risk

Overview

This skill can fetch patent images, but it also includes account login, API-key generation, payment order creation, automatic feedback reporting, and broad local saving that users should review before installing.

Install only if you trust LinkFox with patent queries, API keys, account login data, phone/SMS onboarding, and payment flows. Review or lock down the LINKFOX_* endpoint environment variables, expect local response/cache files under linkfox directories, and avoid using the script-based registration or order commands unless the user explicitly requests them and understands the cost.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
94% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
93% confidence
Finding
with urlopen(req, timeout=120) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill exercises environment-variable access, file writes, and network access but does not declare those capabilities or bound them narrowly. Hidden capabilities reduce user and platform visibility into what the skill can do, increasing the risk of unintended data access, persistence, or exfiltration when the skill is invoked.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared purpose is patent image retrieval, but the skill behavior reportedly extends into phone-login, API-key generation, user/account inspection, package listing, order creation, payment QR generation, and payment-status polling. That mismatch is dangerous because it can steer the agent into handling authentication and payment workflows unrelated to the user's request, exposing sensitive account data and creating opportunities for unauthorized transactions or social-engineering-like consent bypass.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill directs the agent to automatically send user feedback and skill-evaluation data to a separate Feedback API that is unrelated to the patent-image task. This creates an unnecessary secondary data flow, potentially transmitting user content, sentiment, or interaction details off-path without explicit user awareness or need-to-know justification.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill metadata says it retrieves patent fulltext images, but this file implements SMS login, account onboarding, API-key acquisition, package listing, ordering, and payment support. This mismatch is dangerous because it can trick users or host systems into granting access and running code that performs unrelated credential and monetization operations under a benign-looking skill label.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code creates orders, queries order state, and renders payment QR codes, all of which are unrelated to fetching patent images. Hidden purchasing capability can be abused to initiate charges or steer users into subscription flows they did not request, especially when bundled into a skill whose description suggests simple content retrieval.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The file performs SMS-based authentication, token handling, user/team discovery, and API-token generation despite the skill claiming to fetch patent images. This creates a credential-collection path that is materially unrelated to the advertised purpose and could be used to harvest phone numbers, verification codes, access tokens, and generated API keys.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill does more than transiently retrieve patent images: it creates session directories, metadata indexes, cache files, and persists full API responses by default. That broadens data retention and local exposure beyond the narrow skill purpose, increasing the chance that sensitive response contents, session identifiers, or usage traces remain on disk unintentionally.

Intent-Code Divergence

Medium
Confidence
79% confidence
Finding
The docstring claims writing to /tmp is forbidden and that failure to write to the current directory should error, but the implementation falls back to the home directory and temporary directory. This discrepancy is security-relevant because operators may rely on the documented storage guarantees and unknowingly allow data to be written to less controlled locations.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger conditions are broadened so the skill may activate even when the user did not explicitly request patent fulltext images. Over-broad activation increases the chance of unnecessary external calls, token spend, and incidental disclosure of user-supplied identifiers to the patent service when a narrower or different tool would have been more appropriate.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The onboarding instructions define very broad auth/billing trigger conditions, including generic message substrings like 'unauthorized' or 'quota', which can cause the flow to activate in many unrelated error scenarios. In a security-sensitive agent, this can misroute users into credential recovery, registration, or payment flows without strong validation of the actual backend failure mode.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs users to provide a phone number for script-based registration but gives no privacy notice, consent language, retention policy, or warning about how the number will be processed. That creates unnecessary privacy and social-engineering risk, especially because the workflow encourages collecting a personal identifier during an error-handling path.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The order command generates payment artifacts and writes QR code image files to disk without any in-file guardrails, prominent warning, or confirmation step. In a skill that is not supposed to handle payments, this can lead to unexpected purchase prompts and local persistence of payment-related data in predictable directories.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The script writes the full API response to disk by default before deciding whether to print inline or summarize, without an execution-time warning or consent mechanism. Because patent-related APIs may return large or potentially sensitive content, default persistence can create unintended local disclosure and retention risks.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script transmits user-supplied request data along with environment-derived session and application metadata to a remote API, but there is no explicit disclosure at execution time. In this skill context, the network call is expected, but the silent inclusion of extra metadata increases privacy and traceability risk beyond what a user may anticipate.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
88% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.