Shopee-店铺FBS

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:47 PM UTC
• Version: 1.0.5

Overview

This skill mostly does Shopee FBS status lookups, but it also includes account login, API-key generation, payment ordering, and persistent response storage that deserve careful review before use.

Install only if you are comfortable with LinkFox handling Shopee shop identifiers, API keys, SMS login data when onboarding is used, and billing/payment actions when credits are insufficient. Prefer obtaining and setting the API key yourself through LinkFox, avoid using the phone-code onboarding path unless necessary, verify endpoint environment variables are not overridden, and delete local linkfox response/QR files when they are no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, so anyone who can influence runtime environment variables can redirect login and token-bearing requests to an attacker-controlled server. Because this code handles SMS login, access tokens, refresh tokens, and API token generation, SSRF-style endpoint redirection here can directly exfiltrate credentials and session data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The urllib request target is also built from environment-derived base URLs and includes the API key in the Authorization header. If an attacker can set or alter those environment variables, they can redirect requests to capture the LinkFox API key and manipulate account, package, and order operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill documents capabilities to read environment variables, write files, invoke shell/Python scripts, and make network requests, yet it declares no permissions. This creates a transparency and governance gap: reviewers and users cannot accurately assess what the skill can access, which increases the risk of unintended credential use, sensitive data exposure, or unsafe execution in agent environments.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The onboarding document for a Shopee FBS status-query skill introduces unrelated account registration, API key acquisition, and billing/payment flows through an auxiliary script. This expands the skill's effective behavior far beyond read-only FBS status queries and can be used to collect credentials, phone numbers, verification codes, or steer operators into executing privileged workflows not justified by the declared purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documentation grants operational capabilities to register accounts, retrieve API keys, list plans, create payment orders, and query payment status, none of which are necessary for a Shopee FBS status-check skill. Embedding these capabilities creates an unjustified privilege and payment surface that could enable account takeover, unauthorized purchases, or social-engineering of users into sharing sensitive data.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper persistently writes full API responses to local disk, even though the stated skill purpose is only to query and return Shopee FBS status data. Those responses may contain shop identifiers, token-related metadata, operational status, or other sensitive business data, creating unnecessary retention and expanding exposure if the workspace, temp directory, or home directory is accessed by other users or processes.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements a LinkFox onboarding, login, API key issuance, package purchase, and payment workflow, which is unrelated to the declared Shopee FBS status-query skill. Such a capability mismatch is dangerous because users invoking a benign Shopee query skill could instead be funneled into credential collection and paid transaction flows they did not request.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can log users in via SMS and obtain or generate API keys, then use those credentials for additional privileged operations. In the context of a Shopee FBS status-checking skill, this is unjustified credential acquisition and privilege expansion, increasing the risk of account compromise and unauthorized downstream actions.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill creates local session directories and writes QR image artifacts to disk, despite the stated purpose being Shopee FBS status querying. Unnecessary filesystem persistence increases exposure of payment-related and operational artifacts, especially on shared hosts or multi-tenant agent environments.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The trigger rule allows invocation even when the user does not explicitly mention FBS, as long as the request is interpreted as relating to an authorized Brazil shop's FBS status. Overly broad triggers can cause the wrong skill to activate, resulting in unnecessary backend calls, unintended use of stored credentials/shop context, and disclosure or retrieval of shop status data outside the user's precise intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that full API responses are always written persistently to the project directory under a session-based path, but it does not warn that these JSON files may contain sensitive business data such as shop identifiers, enrollment status, invoice errors, block status, or other account-linked metadata. Persistent storage of complete responses increases the risk of data leakage through local filesystem access, repository inclusion, artifact collection, or later prompt exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The phone-based registration path instructs operators to collect a user's phone number and verification code via a script but does not clearly disclose that this information is being transmitted to an external service or explain the privacy and security implications. This creates a meaningful risk of sensitive-data mishandling, user deception, and interception of authentication factors.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code retrieves or generates API keys and performs credential-handling network operations without an in-band warning or consent checkpoint in the execution path. In a mismatched Shopee FBS skill, undisclosed credential collection is especially risky because users would not reasonably expect account-token issuance from a read-only store-status query tool.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The function saves complete API payloads and session metadata in plaintext under predictable local directories, with an explicit workflow for retaining data across runs. In the context of a skill that brokers authenticated Shopee store queries, this creates avoidable data exposure and privacy risk because sensitive store status information may remain accessible long after the request is complete.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 80% confidence
• Finding: External transmission is expected for API clients, but here the transmission includes sensitive login and token workflow data and is combined with environment-controlled endpoints. That makes the network egress more dangerous than ordinary API usage because credentials may be sent to attacker-selected destinations.

Static analysis

No suspicious patterns detected.