Shopee-店铺捆绑优惠

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.5

Overview

The skill mostly does what it advertises for Shopee Bundle Deal management, but it also handles account login, API-key generation, purchases, payment QR codes, destructive store operations, and default full-response persistence in ways users should review before installing.

Review this skill carefully before installing. Only use it in a workspace where storing full Shopee/LinkFox responses under the local linkfox directory is acceptable, confirm destructive actions such as ending or deleting promotions before running scripts, and avoid using the built-in phone/SMS login or payment flows unless you trust the publisher and endpoint configuration. Do not set endpoint override environment variables unless you control the destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST target is ultimately derived from environment-controlled base URLs, so a compromised or untrusted runtime can redirect login and token-bearing requests to attacker infrastructure. Because these requests carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this becomes credential exfiltration rather than a harmless configuration issue.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request path uses environment-derived base URLs and automatically attaches the agent API key in the Authorization header. If an attacker can influence environment variables, they can redirect requests to an attacker-controlled server and harvest the API key and associated account metadata.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes effective capabilities to read environment variables, write files, invoke shell commands, and make network requests, but does not declare permissions or constraints. That mismatch weakens review and user consent, making it easier for a seemingly narrow Shopee skill to access secrets, persist sensitive data, or call unrelated services without clear visibility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior extends beyond Shopee Bundle Deal management into account login, API-key generation, package purchasing, order creation, QR-code payment, and payment-status checks. This is a high-risk scope expansion because a user invoking a store-promotion skill could be steered into credential handling and financial operations that were not part of the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file documents account onboarding, login, API key acquisition, and billing purchase flows that are unrelated to the stated Shopee Bundle Deal business function. Embedding unrelated credential and payment workflows inside this skill broadens the trust boundary, increases the chance an operator will collect sensitive data or perform off-scope actions, and could be abused as a covert channel for account provisioning.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs operators to guide users through registration, login, and paid plan purchase flows even though the declared purpose is managing Shopee Bundle Deal campaigns. This unjustified scope expansion is dangerous because it normalizes collection of personal data and payment interaction in a commerce-management skill, making phishing, social engineering, and unauthorized account lifecycle handling more plausible.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper writes full API responses to local disk regardless of content, while this skill is described as an API forwarding utility for Shopee Bundle Deal management. Those responses may contain shop identifiers, promotion configuration, tokens echoed by upstream systems, error details, or other sensitive business data, creating unnecessary local data retention and a secondary leak surface.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements LinkFox account onboarding, SMS login, token retrieval, plan purchase, and payment QR generation, which is materially unrelated to the declared Shopee Bundle Deal management scope. Scope mismatch is dangerous because it can trick users or hosts into granting execution to code that performs credential acquisition and billing actions outside the expected business function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This section performs SMS-based account login, obtains access and refresh tokens, fetches user/team data, and retrieves or generates API tokens, then returns the API key on stdout. In a skill advertised for Shopee promotion management, this is highly dangerous because it introduces credential-issuance and secret-handling capabilities that can be abused for account takeover or unauthorized downstream API access.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code creates orders, queries payment state, and renders payment QR codes for subscription purchases, none of which are necessary for Shopee Bundle Deal operations. Unrelated billing functionality increases risk of deceptive charging workflows and indicates the skill may be attempting monetization or account actions beyond user expectations.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger is broad enough to activate on loosely related Shopee store-management requests even when the user did not explicitly ask for Bundle Deal actions. In a skill that includes mutation endpoints like create, update, end, and delete, over-triggering increases the chance of unintended operational changes to a live store.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises destructive promotion-management operations such as ending or deleting bundle deals without warning about business impact, reversibility, or the need for explicit confirmation. In an e-commerce context, accidental execution can disrupt active campaigns, pricing strategy, and storefront operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document describes a destructive API operation that removes bundle-deal items but provides no warning, confirmation guidance, rollback caveat, or eligibility checks before execution. In an agent skill context, this increases the chance of accidental or unauthorized destructive actions, especially because the examples show the call can be made directly once a shop is selected via the developer proxy.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation exposes a destructive delete operation and provides direct invocation examples without any warning, confirmation flow, or mention of irreversible effects. In an agent skill context, that omission increases the chance that an automated agent or user triggers deletion of a bundle deal unintentionally, causing business disruption or loss of promotional configuration.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation exposes an operation that ends a bundle deal early, which is an operationally destructive and potentially irreversible business action, but it provides no warning, confirmation guidance, or constraints around when the action should be used. In an agent-skill context, missing cautionary language increases the chance that an automated agent or user invokes the endpoint accidentally, causing premature termination of promotions and business loss across an authorized Shopee store.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown tells operators to run login flows using a user's phone number and one-time verification code without clear safeguards for handling PII and authentication secrets. This can lead to credential interception, insecure storage in logs or shell history, and account takeover if the data is mishandled or the operator is not authorized to process it.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI emits a newly obtained API key directly to stdout JSON, which is commonly captured by logs, orchestration layers, chat transcripts, and shell history. Exposing long-lived credentials this way can lead to unauthorized reuse by anyone with access to those outputs.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs persisting every full API response into a session-linked file under the working directory, which can retain store, campaign, product, and possibly account-related data beyond the immediate task. Because the path is within the project workspace rather than an isolated secure store, other tools, users, or later tasks may read sensitive data unintentionally.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The module persistently stores complete API responses plus session metadata under predictable local directories, including timestamps and session identifiers. In the context of a commerce integration skill, this can retain sensitive merchant/shop data, user inputs, operational metadata, and potentially secrets or token-like material far beyond the immediate transaction, increasing exposure to local compromise, accidental sharing, or forensic recovery.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 84% confidence
• Finding: External transmission alone is expected for a networked CLI, but here the transmission includes authentication and account-recovery data to endpoints that may be environment-overridden. In this context, the network sink is security-relevant because sensitive values are being sent off-host and could be redirected.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.