Shopee-店铺广告

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.6

Overview

The skill mostly matches Shopee Ads management, but it also handles sensitive onboarding, API keys, payments, automatic feedback, and broad data persistence in ways users should review carefully.

Review before installing. Use it only if you intentionally want LinkFox to proxy Shopee Ads requests and you are comfortable with the skill handling shop/ad data, API keys, and possibly billing setup. Avoid sharing SMS codes or creating payment orders through the agent unless that is explicitly intended, verify no endpoint override environment variables point to unexpected hosts, and clean up saved response files that may contain business data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:142

Finding

Autonomous Feedback Transmission Without Explicit User Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_ads_common.py:18

Finding

Credential Exfiltration Through Unrestricted Endpoint Overrides

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` From `scripts/onboarding.py`: ```python def _env_base(name: str, default: str, *fallbacks: str) -> str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _headers(source: str, origin_host: str, *, access_token: st ...[truncated 4169 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_ads_common.py:166

Finding

Sensitive Ads Responses Are Persisted to Undocumented Fallback Locations

Content

View full analysis

/linkfox///data/...` ... **Writing to /tmp is prohibited**, and an error must be reported if the current directory is not writable. ``` The implementation instead uses additional fallback locations: ```python def _lf_root() -> str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` All complete results are then retained: ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() ...[truncated 2345 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:484

Finding

Generated API Keys Are Disclosed Through Standard Output and Plaintext Shell Configuration

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` The instructions recommend plaintext persistence: ```markdown - Windows PowerShell (persistent): `setx LINKFOX_AGENT_API_KEY ""` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` ``` ### Technical Analysis Standard output is commonly captured by Agent transcripts, tool logs, terminal scrollback, CI logs, shell redirection, and monitoring systems. Returning the complete key in JSON therefore exposes it beyond the process that needs it. The recommended configuration commands embed the key directly in a shell command and persist it in plaintext profile files. This can disclose the key through shell history, backups, support bundles, profile-file permissions, or accidental source-contro ...[truncated 1255 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Unpinned Runtime Dependency Installation Guidance

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The runtime error guidance directs users to install packages by mutable names without version pins, hashes, a lockfile, an isolated environment requirement, or a trusted package-index specification. The package names shown are common legitimate packages, and the audit found no evidence that the Skill intentionally references a known malicious or typosquatted dependency. The risk arises from unsafe installation practice: the resolved artifact can vary over time or be influenced by a compromised or attacker-controlled pip index. Python package installation can execute build-system code. Consequently, a malicious artifact selected during installation may execute with the privileges of the user running pip. ### Attack Path 1. The user invokes onboarding in an environment where `requests`, `qrcode`, or `Pillow` is absent. 2. The script instructs the user to run an unpinned `pip install` command. 3. The user’s pip configuration points to a compromised, untrusted, or attacker-controlled package index, or a legitimate package version is compromised upstream. 4. Pip downloads and builds or installs the selected artifact. 5. Malicious installation or imported package code executes with the invoking user’s privileges. ### Impact Assessment A compromised dependency c ...[truncated 440 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (54)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The request destination and multiple outbound headers are influenced by environment variables, including the base URL and authentication/session metadata, and are then sent over the network. If an attacker can influence runtime environment variables, they can redirect requests to an arbitrary host and exfiltrate API keys and session identifiers, which is especially dangerous in an Ads skill handling authorized store operations.

Content

Scanner excerpt · scripts/_shopee_ads_common.py (reported line 87)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The code allows network destinations to be overridden via environment variables and then sends authentication material, login data, SMS flows, and token-related requests to those URLs without any allowlist or host verification. In an agent/runtime environment where env can be influenced, this becomes an SSRF and credential exfiltration risk because API keys, access tokens, phone numbers, and verification codes may be posted to attacker-controlled endpoints.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The gateway request path builds a URL from environment-controlled base values and performs outbound urllib requests with the LinkFox API key in the Authorization header. If an attacker can influence environment configuration, they can redirect these requests to arbitrary servers and capture API keys or abuse the skill as an SSRF primitive against internal or external targets.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A skill presented as Shopee Ads functionality should not also contain SMS verification, phone login, API key generation/retrieval, team/account data access, plan ordering, payment QR generation, or order-status flows. These are sensitive identity, billing, and account-management functions; hiding them behind an Ads-branded skill materially increases phishing, credential abuse, and unauthorized account operation risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A skill presented as Shopee Ads functionality should not also contain SMS verification, phone login, API key generation/retrieval, team/account data access, plan ordering, payment QR generation, or order-status flows. These are sensitive identity, billing, and account-management functions; hiding them behind an Ads-branded skill materially increases phishing, credential abuse, and unauthorized account operation risk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

| `get_product_campaign_hourly_performance` | [references/apis/get-product-campaign-hourly-performance.md](./references/apis/get-product-campaign-hourly-perform

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The onboarding document expands this Shopee Ads proxy skill into unrelated account registration, SMS login, API key acquisition, and billing purchase flows for the Linkfox agent platform. This creates scope creep that can enable the agent to collect credentials, phone numbers, and perform account/payment actions outside the skill’s stated Shopee Ads purpose, increasing the chance of abuse or unauthorized data handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document explicitly authorizes collection of user phone numbers, SMS verification codes, registration/login actions, and plan purchase operations that are not justified by a Shopee Ads integration skill. In context, this is especially dangerous because users invoking an ads-management skill would not reasonably expect identity onboarding and payment handling, making social engineering and over-collection of sensitive data more likely.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements a LinkFox onboarding, login, API-key issuance, plan listing, ordering, and payment workflow that is unrelated to the declared Shopee store ads proxy purpose. Capability mismatch is especially dangerous in an agent skill because it can induce users to disclose phone numbers and SMS codes or perform account/payment actions outside the expected Shopee Ads scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill can create commercial orders and render payment QR codes, which is not justified by the skill's stated purpose of proxying Shopee Ads APIs. In context, this expands the attack surface from ads management into billing/payment initiation, enabling deceptive monetization flows or unauthorized purchases under the guise of a Shopee ads tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code performs SMS-based login and retrieves or generates LinkFox API tokens, which is far outside the declared Shopee Ads operational scope and directly handles sensitive authentication factors. In an agent context, this can be used to phish SMS verification codes, mint long-lived API credentials, and pivot into broader account takeover or unauthorized API use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares capabilities consistent with environment access, filesystem writes, network calls, and shell execution, but does not define an explicit tool scope such as permissions or allowed-tools. Without least-privilege constraints, an agent may invoke broader capabilities than necessary, increasing the blast radius if the skill is misused or its instructions are ambiguous/adversarial.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance is very broad and explicitly allows activation even when the user does not mention ads, as long as the task vaguely relates to an authorized store's promotion or performance. Overbroad triggering increases the chance of unintended invocation, unnecessary access to shop advertising data, and execution of networked actions without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states that full API responses are always written to disk, but does not provide a clear user-facing warning about persistence, retention, or the sensitivity of shop/account/ad data. Persisting data by default can expose business metrics, identifiers, balances, and operational details to other processes, users, or later prompts that access the workspace.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Always saving full responses and sometimes printing full JSON to stdout can leak sensitive shop, campaign, balance, and possibly user/account data into terminal logs, CI logs, transcripts, or shared workspaces. In agent environments, stdout and workspace artifacts are often more broadly visible than the immediate task context, making inadvertent disclosure likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states at L014 that using the tool consumes compute and that repeated probing should be avoided, and L030 also references insufficient balance/quota conditions. However, L140 says "不消耗算力" (does not consume compute). These statements actively conflict and can mislead operators about runtime cost and allowed usage patterns.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The curl example demonstrates sending a sensitive API key and shop identifier to an external gateway endpoint, which is an external transmission of credentialed business data. In the context of an agent skill, users may copy-paste and run this without fully appreciating that ad-account operations and identifiers are routed through a third-party service rather than directly to Shopee.

Content

Scanner excerpt · references/api.md (reported line 108)May include surrounding context.

---

curl 示例

bash

export KEY=$LINKFOXAGENT_API_KEY

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains all user-facing instructions in Chinese, including usage, parameters, and response guidance. Because the file does not offer an alternative language or document that the skill is intentionally limited to Chinese-speaking users, it creates a language-policy concern under the natural-language policy rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation is written almost entirely in Chinese, including operational instructions and parameter explanations, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a language requirement without opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This documentation describes creating ads and forwarding request data through /shopee/developerProxy to Shopee's external Ads API, but it does not clearly warn the user that the action can spend advertising budget or that request contents are sent to a third-party service. In an agent context, missing consent and action-risk messaging can lead to unintended ad creation, financial loss, and disclosure of business campaign data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains core usage instructions, inputs, and operational notes in Chinese only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which it is not here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file's operational instructions and parameter guidance are presented entirely in Chinese, which effectively forces a specific language for users of the skill. Under the policy rule, language constraints should either be optional for the user or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs operators to use a script for phone-based login and API key handling without any warning about the sensitivity of phone numbers, verification codes, or secret keys. This omission encourages insecure collection and transmission of sensitive data and may normalize sharing secrets through the agent workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code sends request data to developer_proxy_call, including identifiers and optional query/body content, but the file contains no confirmation prompt, user-facing log/print, or inline warning explaining that data will be transmitted. For a code file, outbound network transmission of user or system data should have some visible disclosure unless that warning is provided elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.