Shopee-店铺AMS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.6

Overview

The skill is mainly Shopee affiliate campaign tooling, but it also includes account login, API-key setup, payments, automatic feedback reporting, and sensitive local storage that need review before use.

Install only if you are comfortable giving this skill LinkFox credentials for an authorized Shopee store and using it for live affiliate campaign changes. Review any bulk or mutating AMS action before it runs, avoid environment overrides for gateway URLs, treat saved response files as sensitive business data, and do not use the onboarding/payment flow unless you intentionally want LinkFox account setup or billing actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_ams_common.py:18

Finding

Configurable API Gateway Can Exfiltrate LinkFox Credentials

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis The destination receiving the `Authorization` credential is controlled through `LINKFOX_TOOL_GATEWAY` or `SHOPEE_API_BASE_URL`. The code does not validate: - The URL scheme. - The destination hostname. - Whether the destination belongs to LinkFox. - Whether redirects remain on an approved hostname. After accepting the environment-controlled URL, the code attaches the LinkFox API key and session metadata to every request. An attacker who can influence the process environment can therefore redirect credentials to an attacker-controlled HTTP server. Although transmitting an API key to the legitimate LinkFox gateway is necessary for the declared AMS functionality, allowing the credential destination to be changed without v ...[truncated 1215 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_ams_common.py:216

Finding

Unsanitized Session Identifier Enables Response File Path Traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name. The value is neither restricted to safe identifier characters nor checked after path resolution. Consequently, values containing `..`, path separators, or an absolute path can cause `os.path.join()` to resolve outside the intended session hierarchy. The Skill then creates directories and writes the complete API response under the resulting location. The persisted responses can contain commercially sensitive shop information, campaign configuration, commission rates, affiliate identities, and performance data. Files are created using default process permissions rather than explicit owner-only permissions. ### Attack Path 1. An attacker influences the Skil ...[truncated 1164 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_ams_common.py:183

Finding

Complete API Responses May Silently Fall Back to Temporary Storage

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` The declared policy states that complete responses are written under the current working directory, that temporary-directory storage is prohibited, and that an unwritable current directory should produce an error. The implementation instead tries the home directory and the system temporary directory. ### Technical Analysis The implementation silently changes the storage location when preferred directories are unavailable. The final approved candidate is `tempfile.gettempdir()/linkfox`, which is commonly located under `/tmp` on Unix-like systems. This behavior is security-relevant because the Skill always persists complete API responses. Temporary directories are often shared across users and may have weaker lifecyc ...[truncated 1374 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Onboarding Recommends Unpinned Runtime Package Installation

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` The displayed English messages above preserve the installation commands and behavior of the source messages. ### Technical Analysis The Skill has no reviewed lockfile, exact package versions, integrity hashes, or trusted-index requirement. Invoking `pip install` against the active environment allows package selection to depend on: - The configured package index. - Current package releases. - Dependency-resolution results. - Local pip configuration. - A potentially malicious mirror or proxy. Python package installation can execute build-system code. Therefore, a compromised package, dependency, index, or source distribution can run code with the privileges of the user performing installation. This is a supply-chain weakness rather than proof that the named packages are malicious. ### Attack Path 1. The environment lacks `requests`, `qrcode`, or `pillow`. 2. The user follows the runtime installation instruction. 3. The active pip configuration points to a compromised or attacker-controlled package index, or a selected release is compromised. 4. Pip downloads and installs the untrusted pa ...[truncated 625 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:142

Finding

Skill Instructions Mandate Broad Unsolicited Feedback Transmission

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (65)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The HTTP request forwards sensitive credentials and session metadata to an endpoint derived from environment variables (LINKFOX_TOOL_GATEWAY/SHOPEE_API_BASE_URL). If an attacker can influence the environment, they can redirect requests to an arbitrary host and exfiltrate the API key, session identifiers, shop tokens, request bodies, and proxy data; in this AMS context, that can expose affiliate/shop authorization material and business data.

Content

Scanner excerpt · scripts/_shopee_ams_common.py (reported line 88)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The script builds outbound request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, API keys, and user/team identifiers to those endpoints. If an attacker can influence the runtime environment, they can redirect authentication and onboarding traffic to an attacker-controlled host and exfiltrate credentials or perform SSRF-like outbound access.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The gateway request path uses environment-derived base URLs with an Authorization header carrying the agent API key, then performs urllib requests to that destination. A hostile or misconfigured environment can redirect those authenticated requests to an attacker-controlled server, exposing API credentials and enabling unauthorized use of the account.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the skill is described as Shopee AMS campaign tooling but may actually perform phone login, SMS verification, API key generation, account lookup, order/payment creation, status polling, and local file storage. That is a severe mismatch because it expands the trust boundary into authentication, billing, and account management actions that are materially more sensitive than affiliate reporting, potentially exposing users to credential abuse, unintended charges, or privacy leakage.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the skill is described as Shopee AMS campaign tooling but may actually perform phone login, SMS verification, API key generation, account lookup, order/payment creation, status polling, and local file storage. That is a severe mismatch because it expands the trust boundary into authentication, billing, and account management actions that are materially more sensitive than affiliate reporting, potentially exposing users to credential abuse, unintended charges, or privacy leakage.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements LinkFox account onboarding, login, API-key issuance, package listing, ordering, and payment QR generation, which is materially outside the declared Shopee AMS affiliate-management scope. This scope mismatch is dangerous because it expands the skill from API forwarding into credential collection and billing operations, increasing the chance of deceptive user flows, unnecessary privilege access, and unintended financial actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code can create orders and render payment QR codes, enabling direct billing operations that are unrelated to Shopee AMS campaign management. In the context of an affiliate-management skill, this is especially risky because a user may not expect the skill to initiate purchases, creating a pathway for unauthorized or confusing financial transactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends SMS verification codes, logs users into LinkFox, and generates API keys, all of which fall outside the stated Shopee AMS functionality. This introduces credential-handling and identity-verification behavior into a skill that users would reasonably expect to only manage affiliate campaigns, making phishing-like misuse and overcollection of sensitive data more dangerous in context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises capabilities that include environment access, file writes, network access, and shell execution, but does not declare any explicit tool scope or allowed-tools constraints. In a skill that can proxy API calls and write files, missing scope boundaries increases the chance of over-broad execution, privilege creep, or misuse of local and network resources beyond the user’s intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is very broad, including cases where the user does not explicitly mention affiliate marketing so long as the request relates generally to an authorized Shopee store’s promotion or campaign management. Over-broad activation can cause the wrong skill to run, increasing the likelihood of accidental API calls, data access, or file persistence in contexts where the user did not intend to invoke this capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs that complete API responses must always be written persistently to local session-scoped files, but it does not adequately warn about sensitivity of shop, affiliate, campaign, or performance data or the storage consequences. Persistent local storage increases exposure to later unintended access by other tools, users, or processes and may violate data minimization expectations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Always persisting full API responses to session-linked files can capture sensitive operational and business data such as shop identifiers, campaign settings, affiliate lists, and performance metrics beyond the immediate task. Because the files are stored under the current working directory, they may end up inside a project workspace, backup set, or shared environment, increasing the blast radius of any later compromise or accidental disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The feedback section encourages automatic reporting to an external Feedback API whenever there is mismatch, praise, dissatisfaction, or possible improvement, without clear limits on what user content may be transmitted. This creates a risk of exfiltrating user prompts, sentiment, business context, or API results to a third party without explicit consent or minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 118)May include surrounding context.

---

curl 示例

bash

export KEY=$LINKFOXAGENT_API_KEY

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This documentation exposes a bulk action that enrolls all eligible products into an Open Campaign without any explicit warning about the scale, reversibility, or possible business consequences such as unintended affiliate exposure, commission obligations, and broad catalog changes. In the AMS context, this is more dangerous than a normal single-item action because a user may trigger a high-impact marketing change across an entire authorized store with one request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This documentation describes an operation that creates a targeted affiliate campaign but does not warn that the action changes live shop marketing configuration. In an agent setting, missing mutation warnings increase the chance of unintended state-changing calls, especially when users may think they are only querying or previewing data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This documentation exposes a write-capable AMS operation that edits the affiliate list of a targeted campaign, but it does not clearly warn that the action changes live campaign targeting and can affect affiliate participation and commission behavior. In an agent setting, sparse safety guidance increases the chance that a user request is translated into a state-changing API call without adequate confirmation, causing unauthorized or accidental campaign modifications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese for all operational instructions and field descriptions, which can force a specific language on users without opt-in. Under the policy rule, language-specific behavior should either offer user choice or clearly justify the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s operational instructions, parameter descriptions, and response guidance are presented only in Chinese, which effectively forces a specific language for users reading the skill documentation. The policy allows locale constraints only when they are explicitly documented and justified or when users are given a language choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file’s instructional content is predominantly in Chinese, including parameter descriptions and usage guidance, but it does not indicate that the skill is region-specific or provide any user opt-in for language preference. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation is written entirely in Chinese for field labels, usage notes, and parameter descriptions, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate language/locale policy where user-facing skills must not force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation is written entirely in Chinese, including field descriptions and usage guidance, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate a language/locale policy when users are not given an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s operational instructions and parameter descriptions are presented in Chinese, which imposes a specific language on users. There is no indication that the skill supports other languages or that this locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s instructional content and field descriptions are written entirely in Chinese, while nothing in the document indicates that Chinese is optional, user-selected, or required for a region-specific compliance reason. This creates a natural-language policy concern because the skill effectively imposes a language on users without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.