Shopee-店铺加购优惠

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:49 PM UTC
• Version: 1.0.5

Overview

The skill is mostly disclosed as a Shopee promotion tool, but it can change live store promotions, handle login/payment flows, and retain sensitive outputs without enough scoping or confirmation.

Review before installing. Use this only with trusted LinkFox endpoint environment variables, only after confirming the target shop and deal IDs, and require explicit approval before create/update/delete/end or payment/order actions. Treat printed API keys and saved linkfox response folders as sensitive data and clean them up when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The POST target is derived from environment-controlled base URLs, and the function sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and API-token requests to that destination. In a skill runtime where environment variables can be influenced, this enables exfiltration of credentials and authentication material to attacker-controlled infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway request URL is also built from environment-controlled base configuration and used with an Authorization header containing the LinkFox API key. If an attacker can set or influence the gateway base URL, the CLI will transmit the API key and business requests to an arbitrary server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises shell, network, environment-variable, and file-write behavior without any declared permission model or explicit safety boundaries. In practice this lets a seemingly simple commerce-management skill access secrets, write arbitrary project files, and make external requests, increasing the chance of unintended data exposure or misuse if invoked in the wrong context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is Shopee Add-On Deal management, but the skill also routes users into LinkFox account onboarding, SMS verification, API-key retrieval, package purchase, order creation, payment QR generation, and payment-status queries. This is a substantial scope expansion into authentication and billing flows, which can expose users to credential handling and unintended financial actions outside the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file introduces account registration, login, API-key setup, and billing workflows that are outside the stated Shopee Add-On Deal business function. This expands the skill's effective capability to handling identity, credentials, and payment guidance, increasing phishing, credential mishandling, and unauthorized account-enablement risk if triggered in the wrong context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Embedding user-account onboarding and payment support inside a commerce-management skill is an unjustified scope expansion that can be abused to solicit phone numbers, verification codes, or plan purchases unrelated to the user's immediate task. In context, this makes the skill more dangerous because users invoking Shopee campaign management would not reasonably expect account registration and recharge flows to be part of the same capability.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper persistently saves full API responses to local disk, even though the skill is described as an API forwarding/management tool. Shopee API responses can contain store identifiers, campaign details, tokens returned by proxies, error payloads, or user-supplied business data, creating an unnecessary local data-retention and disclosure risk.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code probes multiple filesystem locations for writability and establishes a session-oriented storage area unrelated to core Add-On Deal API operations. In this skill context, that behavior increases data collection and persistence scope beyond what a user would reasonably expect from a forwarding wrapper.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a LinkFox onboarding, login, API-key issuance, plan listing, ordering, and payment workflow that is unrelated to the declared Shopee Add-On Deal functionality. Such hidden, off-scope account bootstrap capability materially increases risk because it can collect credentials and provision tokens under the guise of an unrelated commerce-management skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders, render payment QR codes, and query payment state, none of which are justified by Shopee Add-On Deal management. Hidden purchasing capability inside an unrelated skill can drive unauthorized charges, social-engineer users into paying, or monetize access without transparent review.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section performs phone-based authentication, SMS verification, login, token exchange, team enumeration, and API-token generation, which are unrelated to Shopee Add-On Deal API forwarding. Embedding credential acquisition and token minting in an unrelated skill creates a strong risk of unauthorized account access and secret harvesting.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger condition explicitly allows activation even when the user does not mention the core Add-On Deal concept, as long as the request vaguely relates to authorized Shopee store activity. Because this skill supports destructive promotion-management actions, broad matching raises the risk of accidental invocation and unintended changes to a store's promotional configuration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill exposes multiple destructive operations such as delete, update, and end promotion APIs, but the documentation does not prominently warn users that these actions can irreversibly alter live store campaigns. In the e-commerce context, accidental or misunderstood execution can disrupt pricing, promotions, and sales performance for a real merchant account.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The document instructs use of an API that changes live Shopee promotional configuration by adding main items to an add-on deal, but it provides no warning, confirmation guidance, or operational safeguards. In an agent-skill context, this can lead to unintended modification of a merchant's store promotions if the skill is triggered from ambiguous user intent or used without explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation exposes a live state-changing API that creates Shopee add-on deal promotions and explicitly encourages passing the full body, but it does not warn users that execution will modify production shop promotion data. In an agent setting, missing mutation warnings increases the chance of accidental or overly broad promotional changes, especially when users may not understand that this is not a read-only operation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation exposes a destructive API operation (`delete_add_on_deal`) but does not warn that the action is irreversible or operationally sensitive. In an agent-driven workflow, missing deletion warnings can cause accidental invocation, especially since the skill is designed to trigger from natural-language requests about Shopee Add-On Deal management.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes an operation that can terminate a live promotion early but does not warn the user that the action is destructive and may immediately affect storefront pricing, campaign availability, or revenue. In an agent-driven workflow, omission of a clear confirmation/warning increases the chance of accidental or socially engineered execution against the wrong shop or campaign.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Response data is written to disk without any clear user-facing warning or consent mechanism. Silent persistence of operational/API data can expose sensitive business information to other local users, backups, log collectors, or later unintended reuse.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code retrieves or generates API tokens and returns them to stdout without any in-file warning that sensitive credentials are being created and exposed. In agent or automation contexts, this increases the chance of accidental disclosure through logs, transcripts, or downstream tool chaining.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The helper stores full API responses and session metadata in plain JSON and prints summaries, which can leak sensitive operational data into local files and console logs. Because this is a shared helper used across skill entry points, the leakage risk is broad and systemic rather than isolated.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.