Shopee-店铺AMS

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:51 PM UTC
• Version: 1.0.5

Overview

The skill is mostly a disclosed Shopee AMS integration, but it combines live campaign-changing authority with weak safeguards, credential/billing onboarding, configurable credential-bearing endpoints, and local persistence of full responses.

Review this before installing if you manage real Shopee stores. Use it only in a trusted workspace, confirm every bulk add/remove or campaign termination request manually, avoid environment URL overrides unless you control the endpoint, and treat stdout and saved linkfox data files as sensitive because they may contain API keys or shop performance/campaign data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The code sends authentication material and user data to URLs whose base domains are overridable via environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL. In a hostile or misconfigured runtime, an attacker can redirect login, SMS, token, and API-key issuance traffic to attacker-controlled infrastructure and capture credentials, OTPs, access tokens, refresh tokens, and generated API keys.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 97% confidence
• Finding: The gateway request path uses a base URL derived from environment variables and attaches the LinkFox API key in the Authorization header before calling urlopen. If an attacker can influence environment variables, all gateway calls including account lookup, package listing, order creation, and order queries can be redirected to an attacker-controlled server that harvests the API key and related business data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares powerful capabilities in practice—environment access, file writes, network use, and shell execution—without an explicit permissions model or user-facing disclosure. In this context, that matters because the skill also handles shop-scoped API access and persists responses, so hidden capabilities reduce reviewability and increase the chance of unintended data access or unsafe execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented skill purpose is Shopee AMS campaign management, but the referenced behavior extends into account onboarding, SMS verification, API key generation, plan purchase, payment order creation, QR rendering, and payment-status checks. That is a high-risk scope expansion because it introduces authentication and billing workflows unrelated to the declared business function, increasing the chance of credential capture, unauthorized purchases, or social-engineering-like behavior under an unexpected trigger path.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper unconditionally serializes and writes full API responses to local disk, including potentially sensitive affiliate, shop, token-adjacent, or business-performance data. In this skill context, the responses come from authenticated Shopee AMS and store-token/proxy flows, so silent persistence materially increases exposure through local compromise, multi-tenant hosts, backups, or unintended reuse.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements phone-based account login, API-key retrieval, team selection, package listing, order creation, and payment QR generation, which is materially outside the declared Shopee AMS proxy purpose. Scope divergence is dangerous because it enables unrelated credential collection and commercial account operations under the guise of a Shopee affiliate-management skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create orders and render payment QR codes for LinkFox packages, functionality that is unrelated to Shopee affiliate campaign management. Unjustified billing capabilities increase the risk of unauthorized charges, dark-pattern monetization, or abuse of user trust within an unrelated skill context.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to invoke the skill even when the user does not explicitly ask for affiliate-marketing actions, which increases the risk of unintended execution against authorized shops. In a skill that can query performance data and modify campaign settings, broad matching can expose business data or cause operational changes under ambiguous user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly states that full API responses are always written to project files, but it does not warn that those responses may contain sensitive shop, affiliate, campaign, or performance data. Silent persistence increases the risk of accidental disclosure through source trees, shared workspaces, backups, logs, or later tool access beyond the immediate user request.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation describes a bulk operation that adds all eligible products to an Open Campaign, but it does not warn users that the action is broad, potentially irreversible in practice, and can materially change affiliate exposure and commission behavior across an entire store. In an agent-executed context, missing warnings increase the risk of accidental mass enrollment, especially when users provide only a shop identifier and may not realize every eligible product will be affected.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This documentation exposes a state-changing POST operation that edits the product list of a targeted affiliate campaign, but it does not warn that invoking it will modify live campaign configuration. In an agent-skill context, missing mutation warnings can cause users or upstream agents to trigger unintended promotional changes on authorized Shopee stores, especially because the examples make the call appear routine and low-friction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation describes an irreversible bulk-destructive AMS action, 'Remove all products from Open Campaign', but provides no warning, confirmation guidance, rollback limitations, or operator safety notes. In an agent skill context, terse docs for a mass-removal endpoint increase the chance that an LLM agent or user will invoke it accidentally, causing large-scale disruption to affiliate promotion configuration and revenue.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation describes an operation that terminates a targeted campaign but does not warn users that the action is destructive and may immediately stop affiliate promotion activity. In an agent-driven workflow, missing an explicit confirmation/warning increases the chance of accidental irreversible business-impacting actions, especially when triggered from broad natural-language requests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding instructions tell the agent to collect a user's phone number and pass it into a registration/login flow, but they provide no privacy notice, consent language, retention limits, or guidance on secure handling of that personal data. In an agent context, this can lead to unnecessary collection or disclosure of personally identifiable information and increases the risk of mishandling sensitive user data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code sends authenticated data to external endpoints determined by environment configuration, without any disclosure or consent mechanism in the helper. In an agent skill handling shop and affiliate-management operations, hidden network transmission can expose business identifiers, request bodies, and API metadata beyond what a user may reasonably expect.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This helper writes complete API responses to a predictable local directory tree without any warning, consent, or data-minimization controls. Because the skill processes authenticated Shopee affiliate/store data, silent local persistence can leak commercially sensitive information to other local users, support tooling, backups, or future sessions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The login command prints the freshly obtained API key in stdout JSON, which may be captured by agent logs, shell history wrappers, transcripts, or downstream tools. Exposing bearer credentials in normal command output materially increases the chance of accidental secret disclosure and account compromise.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Requiring automatic persistence of complete responses and grouping them by session creates a durable data trail that can aggregate sensitive shop activity across multiple tasks. In this AMS context, that can expose performance metrics, affiliate relationships, campaign configuration, and other business-sensitive information to anyone with filesystem access or downstream tooling that reads the workspace.

Static analysis

No suspicious patterns detected.