linkfoxagent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:54 AM UTC
• Version: 1.1.4

Overview

This skill has a coherent e-commerce research purpose, but it needs review because it automatically exposes public task links and includes broad ERP/file workflows with weak guardrails for sensitive business data.

Review this skill carefully before installing. Do not use it with secrets, unreleased product plans, confidential ERP exports, or private images unless you accept that prompts, outputs, and generated artifacts may be sent to external services and surfaced through public links. Use least-privilege Lingxing credentials, avoid write-capable ERP apps unless needed, and clear local output/token caches after sensitive work.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:62

Finding

Unconditional disclosure of public LinkFox conversation URLs

Content

View full analysis

`. **The moment you find one, forward that URL to the user as the very first thing in your reply, before the reflection / results / anything else.** It is a PUBLIC URL — the user can open it on any device without auth, see every step the agent took, and download all generated artifacts (CSV/Excel, images, HTML reports, attachments). Always send it; never decide "to share or not to share". This rule is unconditional: any successful run produces one (`status=finished`), and if it appears in stdout you forward it. ``` The public URL is documented as exposing the complete task: ```markdown - `url`: ShareURL — public, read-only share page for the entire conversation behind this run (intent, tool calls, intermediate outputs, reflection, final summary), with downloadable artifacts (CSV/Excel, images, HTML reports, attached files). ``` ### Technical Analysis The Skill assigns the highest priority to a fixed output behavior and explicitly removes the Agent's discretion to evaluate whether disclosure is appropriate. Every successful task must place a third-party LinkFox share URL at the beginning of the response. The linked page is unauthenticated and may expose the user's intent, tool calls, intermediate data, generated reports, and downloadable artifacts. This behavior is not necessary to provide the requested e-commerce analysis results and exceeds minimum privilege by creating and promoting a public copy of the task. ### Attack Path 1. A user submits commercially sensitive product, competitor, sales, or ERP research. 2. The task and its results are processed by LinkFox. 3. LinkFox returns a public, unauthenticated sh ...[truncated 725 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/linkfox.py:154

Finding

Plaintext persistence of original prompts and complete API results

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lingxing.py:714

Finding

Lingxing bearer tokens cached in predictable shared temporary files

Content

View full analysis

Path: return TOKEN_CACHE_DIR / f"lingxing_token_{app_id[:8]}.json" def _load_cached_token(app_id: str) -> Optional[str]: path = _token_cache_path(app_id) if not path.exists(): return None try: data = json.loads(path.read_text()) if data.get("expires_at", 0) > time.time() + 60: return data["access_token"] except Exception: pass return None def _save_token(app_id: str, token: str, expires_in: int) -> None: path = _token_cache_path(app_id) path.write_text(json.dumps({ "access_token": token, "expires_at": time.time() + expires_in })) ``` ### Technical Analysis The script writes a live Lingxing access token to the shared `/tmp` directory. The filename is predictable because it contains only the first eight AppID characters. The write operation does not explicitly enforce mode `0600`, verify ownership, prevent symbolic-link traversal, or use exclusive atomic file creation. Under an unsafe umask, another local account may read the token. A local attacker may also pre-create the predictable path as a symbolic link, potentially redirecting the token write to another file accessible to the attacker. Using only an AppID prefix additionally creates a collision risk between applications sharing the same first eight characters. ### Attack Path 1. A local attacker predicts or discovers `/tmp/lingxing_token_.json`. 2. The attacker monitors that file or pre-creates it as a symbolic link to an attacker-readable destination. 3. The legitimate user invokes the Lingxing CLI. 4. The CLI authenticates and writes a live bearer token to the predictable path. 5. The attac ...[truncated 577 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/lingxing.py:668

Finding

Unpinned installation guidance for a runtime cryptography dependency

Content

View full analysis

str: try: from Crypto.Cipher import AES except ImportError: print( "Error: pycryptodome is not installed. Run: pip install pycryptodome", file=sys.stderr, ) sys.exit(1) ``` The English rendering above preserves the exact installation behavior of the source message: users are instructed to execute `pip install pycryptodome` without a pinned version or integrity hash. ### Technical Analysis The Skill has no lockfile or requirements file specifying an audited version and hash. When the import fails, users are directed to install the latest package resolved by their configured pip index. Package installation may execute package build or installation logic. A compromised release, package index, configured mirror, or dependency chain could therefore introduce arbitrary code into the environment. Although `pycryptodome` is a known package and no malicious package is embedded in this project, the installation process is not reproducible or integrity-pinned. ### Attack Path 1. The Lingxing integration is invoked on a system without `pycryptodome`. 2. The script instructs the user to run the unpinned pip command. 3. Pip resolves the package and dependencies from the configured package source. 4. A compromised source, mirror, release, or dependency supplies malicious installation content. 5. Installation code runs with the privileges of the user executing pip. 6. The malicious package gains access to that user's files, environment variables, and future Lingxing credentials. ### Impact Assessment Successful supply-chain compromise could execute arbitrary code with the installing user's privileges. This may expose `LINGXING_APP_ID`, `LINGXING_APP_SE ...[truncated 95 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lingxing.py:71

Finding

Query-oriented Lingxing CLI exposes state-changing ERP endpoints

Content

View full analysis

dict: """Single call with signing and automatic GET/POST selection.""" is_get = api_name in GET_APIS qp = _sign_params(app_id, token, extra=None if is_get else body) headers = {"X-API-VERSION": "2"} if extra_headers: headers.update(extra_headers) url = HOST + get_api_path(api_name) if is_get: qp.update(body) return _http_get(url, params=qp, headers=headers) else: return _http_post(url, params=qp, json_body=body, headers=headers) ``` The CLI performs no separate confirmation for mutation-like operations: ```python if args.api not in SUPPORTED_APIS: print(f"Error: unsupported API '{args.api}'", file=sys.stderr) sys.exit(1) result = call_api(app_id, token, args.api, body) ``` ### Technical Analysis The script describes itself as a query interface, and the associated documentation emphasizes retrieving ERP data. Nevertheless, its endpoint allowlist includes names and paths indicating live state changes, including setting order remarks and manually adjusting prices. All supported endpoints pass through a generic dispatcher. Non-GET operations are submitted without a read-only policy, mutation classification, interactive confirm ...[truncated 1179 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_image.py:84

Finding

Local images are uploaded with public-read access

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (65)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly requires always forwarding a public ShareURL that can be opened without authentication and reveals the full conversation, execution steps, and downloadable artifacts. Because prompts sent to the service may include business-sensitive research inputs, generated reports, file outputs, and potentially user-provided documents, unconditional disclosure of a public link creates a strong risk of data leakage and unintended third-party access.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This line reinforces that every successful run produces a public, read-only share page containing the full conversation and downloadable artifacts, and instructs the agent to always send it. In the context of a skill handling market research, patent analysis, ERP workflows, PDFs, and uploaded files, that behavior materially increases the likelihood of exposing confidential commercial data or user-supplied content.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/amazon-frontend.md (reported line 1)May include surrounding context.

md

# 亚马逊前台

共 8 个工具。使用 `@工具中文名` 语法在任务提示词中调用。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/linkfox.py (reported line 58)May include surrounding context.

python

def get_api_key() -> str:
    """Get API key from environment."""
    key = os.environ.get("LINKFOXAGENT_API_KEY")
    if not key:
        print(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes broad capabilities through its documented behavior: it reads environment variables, writes local output files, and sends prompts and results to external network services, yet it declares no explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it easier for a caller or future skill changes to access sensitive resources beyond what users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown explicitly instructs the agent to tell the user a fixed Chinese message before dispatching a task. This imposes a specific language on user-facing output regardless of the user's language preference, which is a natural-language locale policy violation unless the user opted into Chinese or the skill is clearly constrained to Chinese-only usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requires a fixed Chinese message when spawning multiple tasks in parallel. Because this is a mandatory user-facing utterance with no language choice or opt-in, it enforces a locale/language on all users and violates the language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The parameter description states that the product search keyword 'must be Chinese' and instructs the system to translate it first if it is not. This imposes a language constraint on the user's input without offering a choice or opt-in, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the search keyword 'must be Chinese' and directs translation when it is not. This is a natural-language policy issue because it mandates a specific language rather than offering the user a choice or clearly framing it as an external platform limitation with consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states that users must invoke tools using the @工具中文名 syntax, which imposes a specific language requirement. This is a natural-language policy concern because no alternative locale or opt-in is provided for non-Chinese users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L033 says keywords should be translated to the corresponding country's language, such as using English for the US and German for Germany. This imposes a locale/language behavior by default rather than offering user opt-in or indicating that the user may choose their preferred language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L129 states that prompts can be organized freely in natural language with no fixed template. In a markdown skill description, this lacks clear trigger boundaries or exclusion conditions and can increase the chance of unintended invocation from ordinary shopping-related requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file instructs users to call the tool using the @工具中文名 syntax, which imposes a Chinese-language naming convention. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; this file does not provide such justification or an alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Line L41 states that keywords 'must' be in the country's language and instructs translation if they are not. This is a natural-language locale policy constraint that forces a specific language based on region, without any opt-in, alternative, or documented justification for the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction requires the keyword to use the language of the selected marketplace, such as English for the US site and German for the DE site. This is a natural-language locale constraint presented as mandatory behavior, with no indication that the user may choose another language or opt in to translation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This line states that the keyword is required and must be translated into the language of the selected country. That enforces locale behavior as a policy in the skill description rather than offering translation as an option the user can accept or decline.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The parameter description mandates translating the keyword into the selected country's language. This is a forced locale/language behavior and does not provide a user choice or documented exception.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file states users must invoke the tools using the @工具中文名 syntax, which imposes a specific language requirement. This is a natural-language locale policy concern because no alternative language option or opt-in is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document instructs operators to set Lingxing ERP API credentials and use them to pull live ERP data from an external service, but it does not include any warning about credential sensitivity, data handling, access scope, logging exposure, or the privacy implications of retrieving production business data. In an agent-skill context, this is risky because users may paste secrets or authorize broad data access without understanding that order, inventory, finance, and ads data will be transmitted to a third-party API and may also appear in shell history, task logs, or subprocess output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The parameter description states that the search keyword must be in Russian, which is a language constraint expressed in natural language. Under the policy rule, forcing a specific language without user opt-in or clear documented justification is a reportable locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly says the category path must be Russian, which imposes a specific language requirement on the user. The document does not offer a language choice, opt-in flow, or policy justification beyond the bare requirement, so it matches the natural-language language-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file instructs users to invoke tools using the @工具中文名 syntax, which requires Chinese tool names and effectively imposes a specific language for interaction. The document does not offer an alternative language option or note that other locales are supported.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file presents all instructions and tool invocation conventions in Chinese, including the required '@工具中文名' syntax, which effectively forces a specific language/locale. Because no opt-in, alternative language support, or documented regional justification is provided, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This tool accepts Excel download links and processes file contents without any warning about sending external file URLs or potentially sensitive spreadsheet data into the tool pipeline. In a skill centered on e-commerce research and data aggregation, spreadsheets may contain supplier, pricing, customer, or business-sensitive data, so silent transmission/processing increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The capability description says the Python sandbox supports using an LLM to recognize image URLs, which is an AI analysis capability beyond pure structured-JSON processing. Immediately afterward, the limitations claim it can only process structured JSON data and cannot generate suggestions or analysis reports, which conflicts with the earlier description of LLM-assisted recognition and text-oriented output such as Markdown tables.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/linkfox.py:570

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:13