Security audit

linkfoxagent

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real e-commerce research skill, but it needs Review because it can publish task traces publicly and includes broad business/ERP API authority without strong user controls.

Install only if you are comfortable sending e-commerce prompts, product images, PDFs, and optional ERP data to LinkFox and related services. Do not include secrets or confidential material in task prompts, avoid using it in shared machines unless outputs are segregated, and be especially careful with Lingxing credentials because the bundled ERP helper can reach sensitive and potentially state-changing business APIs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares only an environment-variable requirement in metadata, but the instructions clearly direct use of local file reads/writes and outbound network access via scripts and APIs. This permission mismatch weakens operator visibility and consent, making it easier for the skill to access local task artifacts and external services beyond what a minimal manifest suggests.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill mandates forwarding a public ShareURL as the first output whenever present, and that URL exposes the full execution trace and downloadable artifacts without requiring additional authorization. Even for ordinary e-commerce tasks, prompts, intermediate reasoning-like reflections, uploaded materials, and generated files may contain sensitive business data or user-provided content that should not be broadly shared by default.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documentation instructs the agent to upload local files to a public URL valid for 24 hours when image inputs are needed. That creates a direct data-exposure path from local user files to an externally accessible location, which is risky if the file contains sensitive content or if the user did not explicitly consent to publication.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The header, usage text, and CLI description present the script as a query-only Lingxing OpenAPI tool, but the registered API list includes state-changing endpoints such as remark updates, refunds, pricing adjustments, and report/task creation. This mismatch can mislead downstream agents or users into invoking the tool in contexts where only read-only access was intended, increasing the risk of unintended remote modifications.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The comments and help text repeatedly describe the CLI as a query interface, while the implementation exposes mutating API calls. In an agent skill context, deceptive or inaccurate safety framing is itself dangerous because orchestration layers may rely on descriptions to determine whether a tool is safe to invoke autonomously.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The file instructs users to invoke tools with a simple `@工具中文名` pattern, but it does not define strict trigger boundaries such as requiring an explicit command context or disallowing mention-only references. In an agent setting, this can cause accidental or prompt-injected tool execution when a tool name appears in quoted text, examples, or untrusted content.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The tool simulates Amazon frontend behavior by setting a delivery address or generating a postal code, but the documentation does not clearly warn users that location-like data will be used or synthesized. This can create privacy and consent issues, especially if users do not realize the agent is impersonating location context to alter results.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The image-search tool accepts arbitrary image URLs without warning users against supplying private, expiring, intranet, or credential-bearing links. If the backend fetches these URLs, this can expose sensitive images or enable server-side requests to unintended resources, increasing privacy and SSRF-style risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The patent and IP-risk tools accept external image URLs, titles, descriptions, and other product data, but the documentation does not warn that these inputs will be transmitted to third-party services. In this skill context, users may submit unreleased product images, listings, sourcing details, or proprietary research, creating confidentiality, privacy, and compliance risks if data is shared without explicit notice or consent.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger examples are broad, everyday phrases that can overlap with normal user requests, increasing the chance that this skill is invoked unintentionally. In an agent environment with tool access, accidental activation can cause unnecessary external queries, data processing, or unexpected actions the user did not explicitly intend.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The instruction makes this web-search tool mandatory for essentially all general internet searches outside a few named platforms, creating an overly broad routing rule. Broad mandatory use of a live web search capability increases exposure to untrusted content, prompt injection in retrieved pages, and accidental use of a non-specialized tool where safer or more constrained workflows would be appropriate.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The access token is persisted under /tmp, a shared and commonly accessible location on multi-user systems, without permission hardening or user warning. Any local user or co-tenant process that can read the cache file may reuse the bearer token to access Lingxing APIs until expiry.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script submits arbitrary task text to a remote third-party API, but the CLI behavior does not provide a prominent consent or warning at submission time that user input leaves the local system. In a security-sensitive agent environment, users may paste proprietary product, account, supplier, or legal research data assuming local processing, creating an inadvertent data exfiltration risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persistently stores submitted task text, message IDs, URLs, and timestamps under scripts/output without an explicit warning to the user. Because this skill handles market research, supplier sourcing, patent analysis, and potentially ERP-related requests, saved tasks may contain commercially sensitive or confidential information that remains on disk longer than expected.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script uploads a local image to a remote presigned URL and explicitly sets the object ACL to public-read, then returns a public URL by stripping the query string. While this matches the tool’s stated purpose, it creates a confidentiality risk because users may not realize the uploaded file becomes publicly accessible for at least the stated retention window, and there is no explicit confirmation or warning at upload time.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill requires unconditional disclosure of a public ShareURL that reveals the full execution trace and downloadable artifacts, potentially including user prompts, intermediate outputs, uploaded files, CSVs, reports, and other derived data. Because the rule is mandatory and first-priority, it bypasses contextual judgment about whether the task involved confidential market research, credentials accidentally pasted by a user, or proprietary business documents.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill documents how to recover prior message IDs from local state and directly access historical result files on disk, including original tasks and generated CSV outputs. In a shared or multi-tenant environment, this increases the risk of cross-task data exposure, letting later interactions retrieve earlier users' inputs and outputs in plain form without strong isolation guarantees.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/linkfox.py:570

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:13