Shopee-店铺授权

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:40 PM UTC
• Version: 1.0.5

Overview

The skill mostly performs Shopee authorization tasks, but it also includes under-disclosed account login, API-key generation, payment/order flows, automatic feedback reporting, and persistent storage of full responses.

Review this skill carefully before installing. Use it only if you trust LinkFox with Shopee store authorization, local response files, and account/billing support flows. Avoid entering phone numbers, SMS codes, or initiating plan payments through the agent unless you intentionally want LinkFox account onboarding or billing help, and consider clearing generated linkfox session files and saved authorization URLs after use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 91% confidence
• Finding: The request destination is derived from environment-controlled base URLs, allowing an attacker who can influence the runtime environment to redirect authenticated requests to an arbitrary server. Because the script attaches the API key in the Authorization header, this can leak credentials and shop authorization data to an attacker-controlled endpoint.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends highly sensitive data to them via requests.post, including phone numbers, SMS codes, access tokens, refresh tokens, and authorization headers. In a skill/runtime environment where environment variables can be influenced by deployment or a hostile wrapper, this enables silent exfiltration of credentials and session material to attacker-controlled endpoints.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is also derived from environment variables and used in urllib.request.urlopen with the LinkFox API key attached in the Authorization header. If the base URL is redirected to an attacker-controlled service, the skill will transmit API keys and account/order data to that endpoint, enabling credential theft and account misuse.

Tainted flow: 'req' from os.environ.get (line 44, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 92% confidence
• Finding: The request destination is indirectly controllable via environment variables because API_BASE_URL can be overridden by LINKFOX_TOOL_GATEWAY or SHOPEE_API_BASE_URL. The same request includes the Authorization API key header, so if an attacker can influence the environment, they can redirect the request to an attacker-controlled host and exfiltrate the credential. In an agent/skill execution context, environment-driven network destinations are especially sensitive because secrets are commonly injected through env vars.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill describes capabilities to read environment variables, invoke shell/Python scripts, perform network calls, and persist responses to disk, yet it declares no permissions or equivalent safety boundary. This makes the skill harder to review and can lead to unexpected execution, data access, and data retention beyond what a user would reasonably infer from the metadata.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documentation claims the skill is for Shopee authorization and store management, but it also instructs onboarding and billing-related flows such as SMS login, API key retrieval/generation, plan purchase, QR-code payment, and order-status checks. Hidden authentication and payment behaviors materially expand the trust boundary and can manipulate users into disclosing credentials or initiating financial actions they did not request.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill includes automatic feedback reporting as a side effect unrelated to the stated Shopee authorization purpose. Silent outbound reporting can transmit user interaction details or operational context without clear consent, creating unnecessary data-sharing and privacy risk.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The documentation adds a public feedback submission API that is outside the stated Shopee authorization and store-status scope. Extra capabilities increase attack surface and can enable unintended outbound data transmission or misuse from an agent that should only handle store authorization tasks.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: A feedback submission capability is not justified by the skill's declared business function and creates an unexpected side-channel to an unrelated domain. In agent settings, such mismatched functionality can be abused to exfiltrate conversation content, identifiers, or operational metadata under the guise of feedback.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file documents generic auth recovery, API-key provisioning, user registration, and billing workflows for the Linkfox agent platform rather than Shopee store authorization. This broadens the skill’s operational scope into credential handling and account/payment onboarding, creating a confused-deputy risk where a commerce authorization skill can solicit sensitive data and drive unrelated account actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The documentation explicitly instructs the agent to ask for a user’s phone number and run send-code/login commands to register or authenticate an account. In a Shopee store authorization skill, this is unjustified collection of personal data and enables credential interception or unauthorized account creation/login flows under the guise of store binding support.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill includes billing plan selection, order creation, payment method handling, and payment-status querying that are unrelated to Shopee seller authorization. Embedding payment workflows in this skill increases the chance of social engineering, unwanted purchases, and handling of financial interactions outside the user’s expected task context.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper serializes and writes full API responses to local files and also records session metadata, which can expose authorization tokens, shop identifiers, account details, or other sensitive response fields beyond the skill’s stated purpose of authorization/query handling. Because Shopee authorization flows commonly involve sensitive merchant data, persistent local storage materially increases confidentiality risk and creates a secondary data store that may be read by other local users, processes, or later sessions.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The code derives storage locations from environment and home/temp paths, then creates reusable session archives across runs. While this appears intended for convenience rather than abuse, it expands the skill’s data handling surface beyond its declared Shopee authorization role and can cause sensitive outputs to be written into shared or weakly controlled directories, especially when ACPX_WORKSPACES, home directories, or temp locations are accessible by other users or tools.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script copies the authorization URL to the system clipboard and writes it to local storage automatically. Authorization URLs often contain sensitive state, tokens, or one-time grant material, so exposing them through the clipboard or filesystem increases the chance of leakage to other local processes, users, backups, or support tooling.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements LinkFox account onboarding, SMS login, API-key issuance, package browsing, ordering, and payment flows, which are materially unrelated to the declared Shopee store authorization skill. This scope mismatch is dangerous because it introduces credential collection and billing capabilities under a misleading skill identity, increasing the risk of user deception and unauthorized account monetization.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Order creation and payment QR rendering are monetization features unrelated to Shopee store authorization, yet they are embedded in this skill with the ability to create orders and present payment artifacts to users. In the context of a misdeclared skill, this can facilitate deceptive charging, social engineering, or unauthorized purchases under the guise of store binding/authorization.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This section performs SMS-based LinkFox authentication, retrieves user/team information, and generates API tokens, none of which correspond to Shopee seller authorization. Because the skill is presented as a Shopee authorization tool, these credential and token issuance flows are especially dangerous: they can harvest user login factors and mint long-lived API access under false pretenses.

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The trigger rules are intentionally broad, allowing activation even when Shopee or authorization is not explicitly mentioned. Over-broad routing can cause the skill to capture unrelated requests, invoke networked account flows unexpectedly, and expose users to unintended authorization, billing, or data-storage side effects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs persistent writing of full API responses into the working directory, but it does not clearly warn the user that local files will be created and retained. Because these responses may include store identifiers, authorization metadata, and operational details, silent persistence increases the risk of local disclosure, accidental commit, or reuse by other tools.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions direct collection of a user phone number for registration and OTP login without any privacy notice, retention statement, or minimization guidance. Even if intended for support, requesting PII in chat materially increases privacy and account-takeover risk, especially when tied to authentication flows.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Response data is written to disk automatically with no user-facing warning, confirmation, or opt-in. In the context of a store authorization skill, users may reasonably expect transient processing, not silent archival of merchant authorization responses and metadata, so this creates an undisclosed privacy and security risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persists the authorization URL to a predictable file location without prior disclosure in its primary description or usage flow. This creates an unnecessary local secret exposure path and may cause users or calling agents to mishandle a URL that should be treated as sensitive and short-lived.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The documented workflow logs complete responses in session-organized files, which may retain sensitive authorization state, store metadata, and possibly token-related fields in plain JSON. Persistent plaintext logging broadens the exposure window and creates secondary leakage risks through backups, shared workspaces, or source-control accidents.

Static analysis

No suspicious patterns detected.