Shopee-店铺加购优惠

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 1.0.6

Overview

The skill mostly implements Shopee Add-On Deal management, but it also handles credentials, billing, and persistent data storage with weak scoping that users should review before installing.

Install only if you trust LinkFox with Shopee store operations, account onboarding data, and billing flows. Avoid using environment URL overrides, treat generated API keys as secrets, do not paste SMS codes or payment actions unless you intended them, and review saved linkfox output files for sensitive store data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_add_on_deal_common.py:18

Finding

Environment-controlled API endpoints can redirect credentials to an attacker-controlled server

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding implementation independently permits its three credential-bearing services to be replaced: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ### Technical Analysis The destination receiving authentication material is selected directly from environment variables without validating the URL scheme, hostname, port, embedded credentials, or fin ...[truncated 2559 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_add_on_deal_common.py:216

Finding

Unsanitized SESSION_ID permits traversal outside the intended response-storage directory

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding code follows the same unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name even though it comes directly from the environment. No validation rejects path separators, `..` components, absolute paths, drive-qualified paths, or platform-specific traversal syntax. ...[truncated 2257 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:478

Finding

Generated API keys are disclosed through standard output and documented plaintext persistence

Content

View full analysis

dict: hdr = _headers("agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id) for path, source in (("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated")): resp = _http_post(f"{_agent_user_base()}{path}", {"id": group_id}, hdr) if "_error" in resp: return {"error": f"{path.rsplit('/', 1)[-1]}: {resp.get('_body') or resp['_error']}"} tok = _extract_token(resp) if tok: return {"api_key": tok, "source": source} ``` ```python return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` The complete object is printed to standard output: ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key source: {r['source']}", file=sys.stderr) return 0 return 1 ``` The onboarding documentation then recommends persistent plaintext storage: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The login workflow ...[truncated 1979 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (49)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination is derived from environment-controlled API_BASE_URL and the code sends the API key plus session/app metadata to that endpoint. If an attacker can influence environment variables or deployment configuration, they can redirect requests to an arbitrary host and exfiltrate credentials and sensitive tenant/session context.

Content

Scanner excerpt · scripts/_shopee_add_on_deal_common.py (reported line 88)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and team identifiers via requests.post. In an agent-skill environment, environment variables are a trust boundary; if they are altered, the script can silently exfiltrate credentials to attacker-controlled endpoints.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The gateway helper constructs urllib requests using a base URL derived from environment variables and includes the agent API key in the Authorization header. If the environment is manipulated, authenticated requests for account, package, and order operations can be redirected to an attacker-controlled server, leaking the API key and enabling unauthorized billing or account actions.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a functional Shopee Add-On Deal skill covering multiple Open API operations such as creating, listing, updating, and ending add-on deals. However, the provided code chunk contains no Shopee API calls, no /shopee/developerProxy forwarding, and no Add-On Deal business logic. Its sole purpose is to detect whether the separate linkfox-shopee-store-auth skill is installed by inspecting environment variables and common local skill directories for SKILL.md. This is a materially different primary purpose from the declared behavior, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about managing Shopee Add-On Deal promotional campaigns for Shopee stores. The supplied code does not reference Shopee, stores, Add-On Deal entities, or any of the named endpoints such as add_add_on_deal or get_add_on_deal_list. Instead, it is a standalone CLI for LinkFox onboarding and billing workflows. It interacts with LinkFox endpoints to send SMS codes, authenticate users, obtain API keys, inspect user/team info, list subscription packages, create orders, and render payment QR codes. This is a materially different primary purpose and includes significant undeclared capabilities unrelated to the declared Shopee functionality.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file is described as a Shopee Add-On Deal skill, but the actual code is an onboarding and commerce CLI for LinkFox account login, API-key issuance, plan listing, ordering, and payment handling. That mismatch is dangerous because it disguises unrelated credential collection and billing behavior under a benign marketplace-management label, increasing the likelihood of user deception.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The order-handling logic performs package lookup, creates purchase orders, and renders payment QR codes even though the skill is supposed to manage Shopee Add-On Deal campaigns. In context, hidden billing capability is especially risky because a user invoking a commerce-management skill would not reasonably expect purchase initiation against the platform operator itself.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code performs SMS-based login to LinkFox, obtains access and refresh tokens, fetches team information, and generates agent API tokens—behavior wholly unrelated to Shopee Add-On Deal forwarding. In this context, the mismatch strongly suggests credential harvesting or unauthorized privilege bootstrapping disguised as a store-management add-on.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares shell, network, environment-variable, and file-write behavior in the documentation but provides no explicit tool-scope or permission boundaries. In an agent setting, this creates unnecessary ambient authority: the skill can read secrets, write persistent files, and make outbound calls without a manifest-level restriction, increasing the blast radius if invoked unexpectedly or combined with prompt abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger condition is intentionally broad, including activation even when the user does not explicitly mention '加购' so long as the request vaguely relates to Add-On Deal management. Over-broad invocation criteria can cause the wrong skill to run on ambiguous requests, leading to unintended network actions or state-changing API calls against an authorized store.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to persist full API responses to the project directory by default, but does not clearly warn that those responses may contain sensitive shop, product, campaign, or account-linked data. Persistent storage in a shared working directory raises the risk of later unintended disclosure through repository commits, workspace sharing, or access by other tools/sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Always saving complete API responses under a session-organized path in the current project directory creates durable data retention beyond the immediate task. In this skill context, the responses may include store identifiers, promotion details, inventory-linked items, and operational metadata, so default persistence materially increases confidentiality exposure and cross-task data leakage risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation says the tool both consumes compute and may fail for insufficient balance, yet later states '不消耗算力' ('does not consume compute'). Contradictory cost semantics can mislead the agent or user into repeated invocations they would not otherwise authorize, creating unexpected spending, quota exhaustion, or abusive retry behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file describes operations such as end_add_on_deal and delete_add_on_deal / delete_*_item, which can terminate promotions or remove configured items, but it provides no cautionary note about their potentially irreversible effect on store data or active campaigns. Under the markdown-specific warning rule, user-facing documentation should disclose behaviors that may affect user data or system integrity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 53)May include surrounding context.

---

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/shopee/developerProxy \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document exposes a state-changing POST operation that adds sub-items to a live Shopee add-on deal, but it does not instruct the agent to obtain explicit user confirmation or warn that remote store promotional data will be modified. In an agent setting, this increases the risk of unintended or prompt-induced actions that alter production e-commerce promotions, potentially causing pricing, merchandising, or revenue-impacting mistakes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This documentation describes a destructive operation that removes a main item from an add-on deal but provides no explicit warning, confirmation guidance, or mention of irreversible business impact. In an agent skill context, sparse safety guidance can cause an agent or user to invoke the endpoint without understanding that it mutates live store promotions and may disrupt active campaigns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document exposes a destructive operation that removes sub-items from an add-on deal, but it does not include any warning, confirmation guidance, or rollback/caution language. In an agent setting, this increases the chance that an LLM or user invokes the action unintentionally, causing unwanted promotional changes in a live Shopee store.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This documentation exposes a destructive delete capability for add-on deals but provides no warning, confirmation, or operator-safety guidance before invoking it. In an agent setting, vague user requests or automation mistakes could cause irreversible deletion of live promotions, making the absence of guardrails materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation exposes an API operation that ends an add-on deal early, which is an irreversible business action, but it provides no warning, confirmation guidance, or operator-safety notes. In an agent skill context, this increases the chance that an automated workflow or user request could terminate promotions unintentionally, causing financial loss or operational disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The onboarding instructions direct the agent to solicit a user's phone number and then transmit it to an external registration/login flow, but they provide no explicit privacy notice, consent step, or data-handling limitation. In an agent context, this can cause users to disclose personal data without understanding that it will be sent to a third-party service and processed outside the current conversation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill's stated purpose is to manage Shopee Add-On Deal activities through storeTokens and developerProxy endpoints. Spawning a separate Python process to run check_auth_dependency.py is an additional code-execution capability that is not part of Add-On Deal API handling and is not declared in the manifest description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_shopee_add_on_deal_common.py (reported line 37)May include surrounding context.

python

print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr)
        sys.exit(DEPENDENCY_EXIT_CODE)
    try:
        result = subprocess.run(
            [sys.executable, str(checker)],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code forwards SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME in every API request without any visible necessity check or user disclosure. In this skill context, those identifiers may reveal conversation, tenant, or application metadata and increase privacy risk, especially when combined with the environment-overridable endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.