Shopee-商品详情

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:54 PM UTC
• Version: 1.0.1

Overview

The skill mainly does Shopee product lookup, but it also bundles LinkFox account login, API-key generation, billing, payment QR creation, automatic feedback reporting, and broad local persistence that users should review carefully.

Install only if you are comfortable with a paid LinkFox-backed lookup skill that may ask for phone/SMS login, generate or use API keys, list plans, create unpaid payment orders/QR codes, send feedback externally, and save full responses under local linkfox directories. Prefer manual account setup and payment through LinkFox's site, keep API keys scoped, and avoid endpoint override environment variables unless you fully trust the environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, and the request can carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys. In a skill environment, allowing env-controlled endpoints creates an exfiltration/SSRF channel where a modified runtime can redirect authentication traffic to an attacker-controlled host.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request URL is built from environment-derived base configuration and is used with an Authorization header populated from environment API keys. If an attacker can influence environment variables, requests including bearer credentials and account/order operations can be redirected to an arbitrary server, causing credential leakage and unintended outbound access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly uses environment variables, network access, and project-local file writes. This creates a transparency and consent problem: the agent may access secrets and persist fetched data without an explicit permission model, making misuse or unexpected data handling harder to detect or control.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a Shopee product-detail lookup, but the referenced onboarding flow expands into account login, SMS verification, API key generation, account data access, plan listing, order creation, payment QR rendering, and payment-status checks. That is a major scope expansion into identity, billing, and payment operations, which can expose users to credential harvesting, unintended purchases, or collection of sensitive account metadata unrelated to the stated task.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The instruction to auto-detect and send user feedback through a separate Feedback API introduces data exfiltration beyond the product-lookup purpose. User comments, dissatisfaction, and intent mismatches can contain sensitive business context or personal data, and sending them externally without explicit consent is not necessary to fulfill the lookup request.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file documents a separate public feedback endpoint that is unrelated to the stated Shopee product-detail lookup capability. Adding an auxiliary network action increases the skill’s effective scope and creates a path to send user-derived content to a second service, which can lead to unintended data disclosure, surprise side effects, or abuse if an agent invokes it without clear user consent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, login, token issuance, package listing, ordering, and payment QR generation, which are unrelated to a Shopee public product-detail lookup skill. Such capability mismatch is dangerous because it expands the skill into credential collection and billing flows that users and reviewers would not expect from the declared purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs SMS-based login, exchanges verification codes for access tokens, and then obtains or generates API keys. In the context of a public Shopee detail parser, this creates an unjustified credential-handling path that could harvest user authentication data and mint long-lived secrets beyond the stated skill scope.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file contains order creation, payment method handling, order querying, and QR-code payment rendering, none of which are necessary for reading a public Shopee product page. Embedding purchase and payment workflows in an unrelated skill materially increases the risk of unauthorized charges, social engineering, and hidden monetization behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill writes full API responses plus session metadata to local storage, but the manifest describes a lookup skill and does not disclose persistent local logging. Even if the data is 'public product detail,' responses may still include identifiers, account-scoped metadata, or usage information that users would not expect to be retained on disk.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring states writing to /tmp is forbidden and that failure to write the current directory should error, but the implementation silently falls back to the home directory and temporary directory. This discrepancy can defeat operator expectations and cause sensitive outputs to be written to less controlled locations.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation instructs clients to transmit an API key plus SESSION_ID, MODE_ID, and APP_NAME headers, but does not warn that these are credentials and contextual identifiers being sent to a remote service. This raises the risk of over-sharing sensitive metadata, credential mishandling, and privacy leakage, especially in agent environments where users may not realize such identifiers are forwarded automatically.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs collecting a user's phone number and using it with a local script to send login codes and register for an API key, but it does not include any privacy notice, consent language, retention limits, or guidance on secure handling of that personal data. This creates a real privacy and security risk because operators may process sensitive identifiers and authentication data without informing users how the data is used or protected.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The skill writes payment QR code PNG files to local disk under predictable workspace/home/temp locations without explicit user-facing warning in this file. Persisting payment artifacts can leak billing links or sensitive transaction context to other local processes, shared workspaces, or later users of the same environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script always writes the full API response to disk before deciding whether to print inline, without asking for confirmation or warning the user at the write site. Persistent storage of third-party responses can expose browsing targets, session grouping data, and any returned metadata to later local access or unintended collection.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The request sends the API key plus environment-derived SESSION_ID, MODE_ID, and APP_NAME to a remote endpoint without clear user-facing disclosure in the skill description. In the context of an agent skill, hidden transmission of environment-derived identifiers increases privacy and tracking risk, especially if the gateway is configurable.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill requires always writing full responses to project-local files grouped by session ID, even when stdout summarization is used. Persisting all fetched data by default can leak sensitive commercial context into the workspace, create retention and multi-user exposure risks, and enable path or data-mixing issues if session-derived paths are not tightly controlled.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 89% confidence
• Finding: This code transmits user-supplied and account-related data to external services via HTTP POST, including phone numbers, SMS codes, tokens, and account metadata. External transmission is especially sensitive here because the skill's declared purpose does not justify collecting or sending authentication and billing data.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 84% confidence
• Finding: The alternate environment variable name provides another path for loading bearer credentials from the runtime environment. By itself this is not inherently malicious, but in this codebase it feeds outbound authenticated requests and broad account/order operations that exceed the declared Shopee detail lookup scope.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 84% confidence
• Finding: The alternate environment variable name provides another path for loading bearer credentials from the runtime environment. By itself this is not inherently malicious, but in this codebase it feeds outbound authenticated requests and broad account/order operations that exceed the declared Shopee detail lookup scope.

Static analysis

No suspicious patterns detected.