Skill Trust Decision

linkfox-expert-aba-keyword-heat-analyst (orchestrator + 6 sub-skills)

Name: linkfox-expert-aba-keyword-heat-analyst (orchestrator + 6 sub-skills) Trust Review Report
Item: linkfox-expert-aba-keyword-heat-analyst (orchestrator + 6 sub-skills)
Rating: 80
Author: ClawSafe

亚马逊关键词研究与报告生成工具集，所有功能与声明一致，IOC中的假IP实为反爬User-Agent指纹而非恶意C2，无数据外泄或凭证窃取。

Install decision first Source: ClawHub Scanned: Sep 16, 2026

Files 40

Artifacts 21

Violations 0

Findings 4

Why this conclusion was reached

1/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block

Hidden execution and egress

2 high-risk artifacts or egress signals were extracted.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

5 dependency or supply-chain issues need attention.

What drove the risk score up

硬编码假IP作为UA指纹（反爬规避） +15

Chrome/149.0.0.0 和 model:149.0.0.0 是伪造的浏览器版本/设备型号，用于绕过Amazon反爬检测，非C2基础设施

subprocess调用跨脚本链 +5

resolve_entry.py和generate_report.py通过subprocess调用其他skill脚本，属于正常模块化设计，未执行任意shell命令

Most important evidence

Low Obfuscation

硬编码假IP伪装为浏览器版本/设备标识

onboarding.py:45 将 '149.0.0.0' 嵌入User-Agent字符串 'Chrome/149.0.0.0 Safari/537.36' 及 device model 字段，这是典型的反爬规避技术（伪造浏览器指纹），非恶意C2地址。该包规模大、代码质量高，确为商业化Amazon数据分析工具，假IP仅用于规避Amazon反爬检测。

skills/linkfox-aigc-textgen/scripts/onboarding.py:45

确认目标数据采集已获合法授权；考虑使用标准真实UA以提高透明度

Low Supply Chain

无版本锁定的第三方依赖

suggestion_miner.py 导入 googletrans（pip install无版本锁定）、requests、openpyxl，aba_common.py使用标准库urllib。所有依赖均为常规数据处理库，无已知恶意依赖。

skills/linkfox-amazon-suggestion-miner/scripts/suggestion_miner.py:36

建议在requirements.txt中锁定版本：googletrans==3.0.0, requests>=2.28.0

Info Sensitive Access

访问LinkFox平台API密钥

多文件通过os.environ读取LINKFOX_AGENT_API_KEY，用于LinkFox平台鉴权。所有凭证仅发送至linkfox.com官方域名，未外传。

skills/amazon-aba-kw-heat/scripts/aba_common.py:24

凭证使用符合预期，属于平台正常鉴权流程

Info Doc Mismatch

文档-行为一致，无阴影功能

审查所有7个skill，所有代码行为均与SKILL.md声明一致。无未声明的敏感操作、无隐藏的数据外泄、无文档中未提及的API调用。

SKILL.md:1

无

Declared capability vs actual capability

Network Pass

Declared READ

→

Inferred READ

所有skill均声明网络能力

Filesystem Pass

Declared WRITE

→

Inferred WRITE

保存Excel/JSON报告到本地或OSS

Shell Pass

Declared NONE

→

Inferred NONE

subprocess仅调用python脚本链，未执行bash命令

Suspicious artifacts and egress

High IP Address

149.0.0.0

skills/linkfox-aigc-textgen/scripts/onboarding.py:45

High IP Address

125.0.0.0

skills/linkfox-amazon-suggestion-miner/scripts/suggestion_miner.py:221

Medium External URL

https://tool-gateway.linkfox.com/aba/intelligentQuery

skills/amazon-aba-kw-heat/references/api.md:7

Medium External URL

https://skill.linkfox.com/linkfoxskills/guide.htm

skills/amazon-aba-kw-heat/references/api.md:9

Medium External URL

https://skill-api.linkfox.com/api/v1/public/feedback

skills/amazon-aba-kw-heat/references/api.md:71

Medium External URL

https://test-sz-tool-gateway.linkfox.com

skills/amazon-aba-kw-heat/scripts/aba_common.py:12

Medium External URL

https://.../product.jpg

skills/amazon-aba-kw-heat-report/SKILL.md:73

Medium External URL

https://agent-files.linkfox.com/example/public/echarts.min.js

skills/amazon-aba-kw-heat-report/scripts/generate_report.py:412

Medium External URL

https://agent.linkfox.com/

skills/linkfox-aigc-textgen/references/onboarding.md:7

Medium External URL

https://tool-gateway.linkfox.com

skills/linkfox-aigc-textgen/scripts/aigc_textgen.py:75

Medium External URL

https://agent.linkfox.com/agreement/term

skills/linkfox-aigc-textgen/scripts/onboarding.py:52

Medium External URL

https://agent.linkfox.com/agreement/service

skills/linkfox-aigc-textgen/scripts/onboarding.py:53

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests	`*`	pip	No	无版本锁定，但为可信库
openpyxl	`*`	pip	No	无版本锁定，用于Excel输出
googletrans	`*`	pip	No	无版本锁定，非必需（可选依赖）
oss2	`*`	pip	No	阿里云OSS SDK，无版本锁定
qrcode	`*`	pip	No	onboarding.py二维码生成

File composition

40 files · 9811 lines

Python 14 files · 7791 linesMarkdown 15 files · 1748 linesJSON 11 files · 272 lines

Files of concern · 6

skills/linkfox-amazon-suggestion-miner/scripts/suggestion_miner.py Python · 1823 lines

无版本锁定的第三方依赖 · 125.0.0.0 · https://www.amazon.com/suggestions · https://www.amazon.com/ · https://www.amazon.com

skills/amazon-aba-kw-heat-report/scripts/generate_report.py Python · 956 lines

https://agent-files.linkfox.com/example/public/echarts.min.js

skills/linkfox-aigc-textgen/scripts/onboarding.py Python · 603 lines

硬编码假IP伪装为浏览器版本/设备标识 · 149.0.0.0 · https://agent.linkfox.com/agreement/term · https://agent.linkfox.com/agreement/service · https://agent.linkfox.com/agreement/privacy · https://api.linkfox.com · https://agent-api.linkfox.com

skills/linkfox-amazon-suggestion-miner/scripts/linkfox_paths.py Python · 544 lines

https://tool-gateway.linkfox.com） · https://oss-cn-shenzhen.aliyuncs.com

skills/linkfox-aigc-textgen/scripts/aigc_textgen.py Python · 560 lines

https://tool-gateway.linkfox.com

skills/amazon-aba-kw-heat/scripts/aba_common.py Python · 430 lines

访问LinkFox平台API密钥 · https://test-sz-tool-gateway.linkfox.com

Other files · widget_miner.py · linkfox_paths.py · linkfox_paths.py · resolve_entry.py · resolve_entry.py · analysis-layouts.md

40 files · 375.4 KB · 9811 lines

Python 14f · 7791LMarkdown 15f · 1748LJSON 11f · 272L

├─ ▾ 📁 skills

│ ├─ ▾ 📁 amazon-aba-kw-heat

│ │ ├─ ▾ 📁 references

│ │ │ ├─ 📝 api.md Markdown 87L · 3.3 KB

│ │ │ ├─ 📋 contract.json JSON 104L · 2.5 KB

│ │ │ └─ 📋 examples.json JSON 17L · 300 B

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 aba_common.py Python 430L · 15.6 KB

│ │ │ ├─ 🐍 resolve_entry.py Python 392L · 12.9 KB

│ │ │ └─ 🐍 shell_a.py Python 8L · 234 B

│ │ ├─ 📋 .linkfox-sync.json JSON 9L · 308 B

│ │ └─ 📝 SKILL.md Markdown 130L · 5.7 KB

│ ├─ ▾ 📁 amazon-aba-kw-heat-report

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📋 layout.json JSON 95L · 2.5 KB

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 generate_report.py Python 956L · 38.8 KB

│ │ │ └─ 🐍 resolve_entry.py Python 392L · 12.9 KB

│ │ ├─ 📋 .linkfox-sync.json JSON 9L · 315 B

│ │ └─ 📝 SKILL.md Markdown 124L · 3.6 KB

│ ├─ ▾ 📁 linkfox-aigc-textgen

│ │ ├─ ▾ 📁 references

│ │ │ ├─ 📝 api.md Markdown 149L · 4.9 KB

│ │ │ └─ 📝 onboarding.md Markdown 22L · 2.0 KB

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 aigc_textgen.py Python 560L · 19.4 KB

│ │ │ └─ 🐍 onboarding.py Python 603L · 23.5 KB

│ │ ├─ 📝 SKILL.md Markdown 181L · 9.4 KB

│ │ └─ 📋 _meta.json JSON 5L · 82 B

│ ├─ ▾ 📁 linkfox-amazon-suggestion-miner

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api.md Markdown 79L · 2.7 KB

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 linkfox_paths.py Python 544L · 19.6 KB

│ │ │ └─ 🐍 suggestion_miner.py Python 1823L · 69.9 KB

│ │ ├─ 📋 .linkfox-sync.json JSON 9L · 321 B

│ │ ├─ 📝 SKILL.md Markdown 128L · 6.6 KB

│ │ └─ 📋 _meta.json JSON 5L · 93 B

│ ├─ ▾ 📁 linkfox-amazon-widget-miner

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api.md Markdown 50L · 1.6 KB

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 linkfox_paths.py Python 544L · 19.6 KB

│ │ │ └─ 🐍 widget_miner.py Python 660L · 25.1 KB

│ │ ├─ 📋 .linkfox-sync.json JSON 9L · 317 B

│ │ ├─ 📝 SKILL.md Markdown 104L · 4.6 KB

│ │ └─ 📋 _meta.json JSON 5L · 89 B

│ ├─ ▾ 📁 linkfox-file-upload

│ │ ├─ ▾ 📁 references

│ │ │ └─ 📝 api.md Markdown 61L · 3.4 KB

│ │ ├─ ▾ 📁 scripts

│ │ │ ├─ 🐍 file_upload.py Python 70L · 2.5 KB

│ │ │ └─ 🐍 linkfox_paths.py Python 564L · 20.5 KB

│ │ └─ 📝 SKILL.md Markdown 43L · 3.0 KB

│ └─ ▾ 📁 linkfox-report-generator

│ ├─ ▾ 📁 references

│ │ └─ 📝 analysis-layouts.md Markdown 315L · 11.5 KB

│ ├─ ▾ 📁 scripts

│ │ └─ 🐍 inject_report.py Python 245L · 8.9 KB

│ ├─ 📝 SKILL.md Markdown 165L · 9.1 KB

│ └─ 📋 _meta.json JSON 5L · 86 B

└─ 📝 SKILL.md Markdown 110L · 7.5 KB

Security positives

所有网络请求仅指向合法平台域名（linkfox.com / amazon.com / aliyuncs.com），无未知服务器通信

凭证仅用于平台鉴权，未被外传或写入日志

subprocess调用的是有文档记录的关联skill脚本，非任意shell命令

代码结构完整，错误处理健全，有重试机制和超时保护

无base64解码执行、无eval调用、无敏感文件路径遍历

文档与实现100%一致，无SKILL.md中未声明的阴影功能

Aliyun OSS上传使用STS临时凭证（非永久密钥），符合云安全最佳实践