Shopee-店铺折扣

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.5

Overview

This appears to be a real Shopee discount-management skill, but it can change or delete live promotions, run LinkFox login/payment workflows, and retain full API responses without strong guardrails.

Install only if you trust LinkFox with Shopee store-management access, phone/SMS onboarding, API-key handling, and payment/billing flows. Before using it, require explicit confirmation for any update, end, or delete action, avoid sharing SMS codes unless you intend to create or recover a LinkFox account, and treat saved response files and stdout logs as potentially sensitive business data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 87% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used for authenticated network requests. In this script those requests can carry SMS login data, access tokens, refresh tokens, and API-token management traffic, so a hostile or misconfigured environment can redirect secrets to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 85% confidence
• Finding: The gateway URL is built from environment-controlled values and used by urllib for authenticated API calls that include the LinkFox API key in the Authorization header. If an attacker can influence the environment, they can exfiltrate the API key or redirect billing/order operations to an unintended server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents capabilities to read environment variables, write files, invoke shell/Python scripts, and make network requests through a proxy endpoint, but it does not declare permissions or boundaries for those actions. In an agent environment, this reduces auditability and can enable unintended credential access, local file writes, and external data transmission without clear user-visible controls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The documented purpose is Shopee discount management, yet the finding indicates the skill or its referenced onboarding flow also supports LinkFox account login, API key generation, billing, payment order creation, QR rendering, and order-status queries. Mixing account/authentication and payment operations into a commerce-promotion skill creates hidden high-risk behavior that could expose credentials, trigger purchases, or socially engineer users under the guise of a discount-management task.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file introduces authentication recovery, phone-based account onboarding, and billing/payment workflows that are not part of Shopee discount management. In a skill meant to manage store discounts, unrelated account registration and payment handling materially expands capability scope and creates a path for unauthorized credential collection, account provisioning, or monetization flows under the guise of normal operation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The documentation instructs operators to collect a user's phone number, send verification codes, log in, and initiate plan purchases, none of which is justified by a discount-promotion skill. This creates a high-risk out-of-scope workflow involving identity data and payments that could be abused for unauthorized account creation, account takeover assistance, or deceptive charging flows.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper writes full API responses to local disk under predictable session directories, which can include Shopee business data, tokens returned by upstream services, identifiers, and other sensitive content unrelated to the user's immediate request. This expands the skill from transient API forwarding into persistent data retention, increasing exposure to local compromise, accidental disclosure, and cross-session data leakage.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS login, API-key issuance, package discovery, and payment/order management, none of which are necessary for a Shopee discount-management skill. That capability expansion materially increases the attack surface and enables credential collection and monetization actions outside the declared skill purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script can create orders and render payment QR codes, which is a purchasing capability unrelated to managing Shopee store discounts. In the context of this skill, that mismatch is dangerous because it can drive unintended charges or social-engineer users into paying for unrelated services.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code performs SMS-based LinkFox account login and retrieves or generates API tokens, which is outside the stated scope of Shopee discount management. In this context, the skill becomes a credential and token acquisition mechanism, raising the risk of unauthorized account access and secret misuse.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger conditions are intentionally broad, including cases where the user does not explicitly mention discounts as long as the request is loosely related to managing an authorized shop’s promotions. Over-broad activation increases the chance that the agent invokes a state-changing skill in the wrong context, leading to unintended reads or modifications of live promotion data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises destructive operations such as updating, ending, and deleting discounts/items without requiring any warning, dry-run, or confirmation step. In the context of a live store-management integration, mistaken or ambiguous use could immediately alter pricing promotions, causing business disruption, lost revenue, or customer-impacting errors.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document describes a destructive operation that removes items from an existing discount campaign, but it provides no warning about irreversible business effects, confirmation expectations, or validation requirements. In an agent setting, this increases the risk that a user request is executed without sufficient friction, leading to unintended promotion changes, lost sales opportunities, or operational disruption across an authorized shop.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This documentation exposes a destructive API operation that deletes discount campaigns but does not warn about the operational impact, required confirmation, or potential irreversibility for live promotions. In an agent skill context, that omission increases the chance that an automated workflow or user prompt could trigger deletion of active discounts without informed consent, causing unintended business disruption or revenue loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation exposes a destructive operation ('delete_sip_discount') but does not warn users that it permanently ends or removes a discount, increasing the chance of accidental misuse. In this skill context, the risk is higher because the API is intended to be triggered through an agent workflow for authorized stores, where a mistaken invocation could immediately impact live promotions and revenue.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation describes an API that ends a store discount early, which is an irreversible business action, but it does not clearly warn users that invoking it will terminate a live promotion. In an agent-triggered skill, this omission increases the chance of accidental destructive actions, especially when users ask broadly about discount management and the skill may be auto-selected based on related intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs collection of a user's phone number and use of verification-code login commands without any privacy notice, retention limits, or warning about sensitive-data handling. Even if intended for support, this exposes personal data and authentication factors in a context where users may not expect identity processing, increasing the chance of misuse or leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code silently saves complete API responses to disk without any disclosure or consent mechanism in the helper. Even if intended for usability or debugging, undisclosed persistence of potentially sensitive commerce data creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This script directly exposes a destructive API action (`delete_sip_discount`) and executes it immediately on supplied JSON input, with no confirmation, guardrails, or validation visible in this file. In the context of an agent-triggered commerce skill, that increases the chance of accidental or unauthorized deletion of active discount campaigns, causing business disruption and revenue impact.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI returns the issued API key directly in stdout JSON, which is likely to be captured by logs, transcripts, agent tooling, or downstream integrations. Exposing long-lived credentials in normal output substantially increases the chance of accidental disclosure and subsequent account compromise.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The appended output layer systematically creates session directories, metadata indexes, and raw response archives, forming a durable local data store that exceeds the minimum needed for API proxying. Because this storage is automatic and broad, it materially increases the chance of sensitive data leakage through local filesystem access, backups, shared workspaces, or later unintended reuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 81% confidence
• Finding: This code transmits data to external services, and in this implementation the destination can be influenced by environment-based endpoint configuration. Because the transmitted bodies may include phone numbers, SMS codes, access tokens, and refresh tokens, the external transmission is security-relevant rather than merely operational.

Static analysis

No suspicious patterns detected.