Security audit

Linkfuse

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Linkfuse short-link purpose, but its clipboard command can become unsafe if a returned short URL contains shell syntax.

Use this only if you trust Linkfuse with the destination URLs you submit and can manage the LINKFUSE_TOKEN safely. Avoid running the provided clipboard command as written; copy the displayed short URL manually or use a shell-safe clipboard helper that validates the URL first.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:61
Finding: Shell Command Injection Through Untrusted Short URL
Content: View full analysis
" | xclip -selection clipboard 2>/dev/null || echo -n "" | pbcopy 2>/dev/null || true ``` ### Technical Analysis The workflow instructs the Agent to interpolate the short URL returned by the Linkfuse API directly into a shell command. Double quotes do not prevent shell evaluation of command substitutions such as `$(command)` or backticks. An embedded double quote can also terminate the quoted value and introduce additional shell syntax. The short URL is external data received from `https://app.linkfuse.net/api/v1/links`. Although this is a fixed HTTPS endpoint and there is no evidence that it currently returns malicious values, API responses must still be treated as untrusted. A compromised service, compromised account, malicious upstream value, or unexpected API response could supply shell metacharacters. If the Agent follows the documented clipboard workflow by constructing and executing this command, the shell can evaluate the injected payload. The network request itself is necessary for the declared link-creation functionality: `scripts/create-link.js` sends the user-provided URL and bearer token only to the documented Linkfuse HTTPS API. The token is not logged. The vulnerability is in the optional clipboard command, not in the required API request. ### Attack Path 1. An attacker gains the ability to influence the API response, such as through service compromise or an unexpected reflected value. 2. The API returns a crafted `url` value containing shell syntax, for example a command substitution or a quote followed by shell operators. 3. `scripts/create-link.js` emits that value as the `url` field in its JSON output. 4. The Agent substitutes the returned value for `` in the documented clipboard command. 5. The Agent executes the resulting com ...[truncated 824 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill requires network access and a sensitive environment variable but does not declare any explicit tool scope or allowed-tools boundary. In agent environments, this weakens policy enforcement and can let the skill invoke broader capabilities than intended, increasing the chance of unauthorized network use or mishandling of the API token.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs the agent to write to the system clipboard automatically after creating a link, without requiring an explicit opt-in at execution time. Clipboard contents can overwrite user data or place attacker-controlled content where the user may later paste it into a terminal, browser, or chat, creating a small but real integrity and social-engineering risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.