linkfox-seerfar-ozon-product-report-search

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Seerfar Ozon productReportSearch reads and ingests outsider-controlled free-text only from the user-supplied JSON query parameters (e.g., keywords/tag/sellerName/brand filters) via the POST body and then processes the returned product report JSON.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal, high-entropy values that could act as usable credentials. The only candidate that meets the “literal token / credential” criteria is the base64url string assigned to _LOGIN_FIXED_UID in scripts/onboarding.py. It is not a placeholder name or an obvious example/password; the comment says it is a “fixed uid (实测可用)” used in the login header, which implies it can be used in requests. Therefore I treat it as a potential active credential and flag it.

No other high-entropy literals (API keys, JWTs, private key PEM blocks, or similar) were found. Environment variable names and example placeholders (e.g., $LINKFOXAGENT_API_KEY) were ignored per the rules.