Shopee-店铺头程物流

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:48 PM UTC
• Version: 1.0.5

Overview

The skill mainly supports Shopee FirstMile logistics, but it also includes account login, API-key issuance, billing/payment flows, and durable storage of full business responses that users should review before installing.

Install only if you are comfortable with this skill handling LinkFox account setup, API keys, and billing/payment order creation in addition to Shopee FirstMile logistics. Use it with a dedicated API key, verify any payment or recharge action manually, confirm before bind/unbind operations, and be aware that full API responses may be saved locally with sensitive order or tracking data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from helper functions that read environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, and the request may carry SMS login data, access tokens, refresh tokens, and generated API keys. If an attacker can influence the environment, they can redirect these requests to an attacker-controlled host and exfiltrate sensitive credentials. In a skill context, this is more dangerous because skills often run in shared automation environments where env configuration is externally supplied.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The urllib request target is built from _agent_base(), which is sourced from environment variables, while the Authorization header includes the LinkFox API key. An attacker who controls the runtime environment can redirect gateway traffic and capture the API key or manipulate package/order operations. This is especially risky because the file performs account and payment actions unrelated to the declared Shopee FirstMile purpose, increasing the chance of unjustified credential use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises shell, network, environment-variable access, and file writes without any declared permission model or user-facing constraint. In practice, this reduces transparency and weakens least-privilege expectations, making it easier for a skill to access credentials, call external services, and persist data in ways the user did not explicitly approve.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A FirstMile logistics skill should not also handle LinkFox account login, API-key generation, plan purchase, payment order creation, QR code generation, or payment-status queries unless that behavior is clearly disclosed and scoped. This mismatch is dangerous because a user invoking logistics functionality could unknowingly trigger authentication or payment-related flows, expanding access to account and billing actions beyond the stated purpose.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation says the tool consumes points and warns against repeated queries, but later states that it does not consume points. Contradictory billing semantics are security-relevant because they can mislead the user or agent into performing unintended paid operations or suppressing appropriate consent before retrying costly actions.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file introduces authentication recovery, phone-based registration, and billing workflows that are unrelated to a Shopee FirstMile logistics skill's declared purpose. This expands the skill's operational scope into account provisioning and payment handling, which can expose users to unnecessary credential collection and social-engineering risk if the skill is invoked in normal API failure scenarios.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documentation enables collecting a user's phone number, sending login codes, obtaining an API key, and purchasing plans, none of which are justified by the stated Shopee FirstMile functionality. In context, this creates an unjustified pathway for handling sensitive account and payment operations, increasing the chance of phishing, unauthorized account linkage, or abuse of trust under the guise of logistics support.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This helper writes full API responses to local disk even though it functions as a Shopee API forwarding layer. FirstMile responses can contain shipment, waybill, tracking, shop, and other business-sensitive data, so unconditional persistence creates unnecessary data retention and local disclosure risk if the host, workspace, or temp directory is accessible to other processes or users.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code creates session archives, index metadata, and file catalogs unrelated to the stated purpose of simply proxying Shopee FirstMile API calls. This expands the data footprint and creates an inventory of sessions and stored artifacts that can aid post-compromise discovery or leak operational history.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements a LinkFox onboarding and monetization CLI—SMS login, API-key issuance, plan listing, order creation, and payment QR rendering—which does not match the skill's declared Shopee FirstMile logistics functionality. This mismatch indicates concealed capability expansion and unauthorized credential/payment handling inside an unrelated skill, a strong sign of malicious or at least deceptive behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create orders, query payments, and render payment QR codes even though the skill is supposed to proxy Shopee FirstMile logistics APIs. Embedding purchase/payment functionality in an unrelated logistics skill creates an opportunity for unauthorized charges, user deception, and abuse of the host environment for monetization.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This section performs SMS-based login to LinkFox services, exchanges tokens, fetches team metadata, and generates or retrieves API tokens, all outside the stated Shopee FirstMile purpose. Collecting verification codes and minting platform API keys inside an unrelated skill is a credential acquisition pattern that can enable account takeover or covert privilege expansion.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger definition is broad enough to activate even when the user does not explicitly request FirstMile operations, as long as the request loosely relates to authorized Shopee store shipping or labels. Overbroad activation increases the chance of unintended external calls, data access, or state-changing logistics actions being performed in the wrong context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents automatic writing of full API responses to local storage, but does not clearly warn that these responses may contain sensitive shop, order, shipping, or account-related data. Persisting such data by default creates avoidable exposure through local files, backups, logs, or later agent access beyond the immediate task.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation exposes a bulk destructive operation ('unbind all orders from tracking number') without any warning about irreversible or operationally disruptive effects, and without recommending explicit user confirmation before invocation. In this skill context, the action targets live Shopee logistics bindings for authorized stores, so accidental or misunderstood use could disrupt fulfillment workflows, labels, and downstream warehouse processing across multiple orders.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation exposes an order-affecting unbind operation but does not warn that removing a first-mile tracking binding can disrupt fulfillment workflow, labels, or downstream logistics handling. In this skill context, the action is especially sensitive because it is triggered for authorized Shopee stores and may be executed through a generic proxy interface, increasing the chance of accidental or insufficiently reviewed destructive use.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Always persisting complete API responses into session-organized local files creates a durable data trail that may include order details, tracking numbers, waybills, warehouse information, or other business-sensitive records. In the context of an e-commerce operations skill, this increases the blast radius of any local compromise or unintended reuse of session artifacts.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The result emission path persistently saves complete API responses and session metadata in plain local files and then updates metadata indexes. In the context of a commerce logistics skill, this behavior can expose sensitive order and tracking data beyond the original API transaction and increases breach impact through accumulation over time.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 84% confidence
• Finding: This code transmits sensitive data externally via requests.post, including phone numbers, SMS codes, tokens, and account metadata depending on the call path. External transmission alone is expected for API clients, but here it becomes dangerous because destination control is partly environment-driven and the behavior is unrelated to the advertised Shopee logistics skill.

Static analysis

No suspicious patterns detected.