Shopee-店铺头程物流

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.6

Overview

This skill mainly supports Shopee FirstMile logistics, but it also handles account login, API key generation, payment orders, and retained response data in ways users should review first.

Install only if you are comfortable letting this skill send Shopee logistics data and LinkFox credentials to LinkFox services, store full responses locally, and assist with LinkFox login and payment flows. Use explicit confirmations for bind/unbind and payment actions, avoid overriding API host environment variables, and prefer secure credential storage over shell profile files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_first_mile_common.py:18

Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Environment-Controlled Hosts

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` ```python def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() ``` ```python def _login_by_token(access_token: str, refresh_token: str) -> dict: resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { ...[truncated 2257 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_first_mile_common.py:181

Finding

Untrusted Session Identifier Enables Output Path Traversal and Sensitive Responses Are Stored in Plaintext

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) ``` ```python def _lf_session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding code follows the same unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.g ...[truncated 2337 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:162

Finding

Onboarding Recommends Unpinned Third-Party Package Installation

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The onboarding flow instructs users to install `qrcode`, `pillow`, and `requests` directly from the active pip package index. No version constraints, hashes, lock file, isolated environment, or trusted-index requirement is supplied. The referenced package names are plausible and no typosquatting package was identified in the project. Nevertheless, the effective code installed and imported cannot be determined from the audited artifact. It may change over time or differ according to the user's configured package mirror. Because these packages are loaded by authentication and payment-related code, a compromised dependency could access sensitive process environment variables and user input. ### Attack Path 1. The user invokes onboarding on a system missing `requests`, `qrcode`, or `pillow`. 2. The script displays an instruction to run an unpinned `pip install` command. 3. The user executes the command against the configured package index or mirror. 4. A compromised package release, dependency, mirror, or package-resolution result is installed. 5. Malicious code executes during installation or when onboarding imports the package. 6. The package can read API keys, tokens, phone information, or payment-related data available to the process. ### Impact Assessment A malicious dependency executes with the privi ...[truncated 253 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/onboarding.py:276

Finding

Bundled Account Provisioning and Payment Operations Exceed the Core FirstMile Least-Privilege Scope

Content

View full analysis

dict: resp = _login_post("/user/v3/web/login", { "type": "sms", "method": "login", "systemId": "LinkFoxAgent", "data": {"areaCode": "+86", "authPhone": phone, "authCode": code, "sourceChannel": channel or "skill"}, }) ``` It exchanges access and refresh tokens: ```python def _login_by_token(access_token: str, refresh_token: str) -> dict: resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) ``` It retrieves or generates an API token: ```python def _get_or_generate_api_token(access_token: str, user_id: str, group_id: str) -> dict: hdr = _headers("agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id) for path, source in (("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated")): resp = _http_post(f"{_agent_user_base()}{path}", {"id": group_id}, hdr) if "_error" in resp: return {"error": f"{path.rsplit('/', 1)[-1]}: {resp.get('_body') or resp['_error']}"} tok = _extract_token(resp) if tok: return {"api_key": tok, "source": source} ``` It also creates payment orders: ```python def create_order(plan_id: str, method: str) -> dict: if method not in PAY_METHOD_MAP: raise ValueError(f"不支持的 ...[truncated 3090 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (45)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code sends an Authorization API key plus SESSION_ID, MESSAGE_ID, MODE_ID, and APP_NAME headers to a URL whose base is overridable by environment variables. If an attacker can influence LINKFOX_TOOL_GATEWAY or SHOPEE_API_BASE_URL, requests and secrets can be redirected to an attacker-controlled host, causing credential and metadata exfiltration.

Content

Scanner excerpt · scripts/_shopee_first_mile_common.py (reported line 88)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds destination URLs from environment-controlled base values such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys via requests.post. If an attacker can influence the runtime environment, they can redirect these requests to attacker-controlled hosts and exfiltrate credentials or impersonate backend services.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway URL is derived from environment variables and used in urllib.request.urlopen with the Authorization header carrying the LinkFox API key. A manipulated environment can redirect billing, account, or package-management requests to an attacker-controlled endpoint, leaking the API key and enabling unauthorized use of the account.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the skill claims to handle Shopee FirstMile APIs but may also support LinkFox account login, SMS verification, API key generation, billing, payment QR rendering, and order-status operations. Combining account access and payment workflows under a logistics-themed skill is especially risky because it can expose credentials, enable unauthorized account actions, or socially engineer consent under false pretenses.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the skill claims to handle Shopee FirstMile APIs but may also support LinkFox account login, SMS verification, API key generation, billing, payment QR rendering, and order-status operations. Combining account access and payment workflows under a logistics-themed skill is especially risky because it can expose credentials, enable unauthorized account actions, or socially engineer consent under false pretenses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation explicitly authorizes collecting a user phone number and guiding registration, login, and payment actions through a local script, none of which are justified by the Shopee FirstMile feature set. In skill context, this is especially dangerous because it conditions the agent to solicit personal data and facilitate account/payment flows outside the expected logistics task, increasing phishing and privacy risk.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements LinkFox onboarding, login, token generation, plan listing, order creation, and payment QR rendering, which is materially unrelated to the declared Shopee FirstMile logistics purpose. Such scope divergence is dangerous because it introduces credential handling and billing flows users would not reasonably expect from a logistics skill, increasing phishing, token theft, and unauthorized purchase risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code adds package purchase and payment QR generation capabilities that have no clear justification for a Shopee FirstMile integration skill. Because it can initiate orders and present payment artifacts, a mismatched or compromised skill could trick users into paying for unrelated services under the guise of logistics operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script performs SMS-based account login, token exchange, team selection, and API key retrieval/generation for LinkFox accounts, all outside the expected Shopee FirstMile behavior. This is dangerous because it collects highly sensitive authentication factors and can mint long-lived API credentials, enabling account takeover or privilege abuse if the flow is misused or redirected.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares capabilities that include environment access, file writes, network access, and shell execution behavior, but it does not declare an explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where the agent may invoke powerful primitives without clear policy constraints, increasing the blast radius if the skill is triggered unexpectedly or misused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger logic explicitly allows activation even when the user does not mention FirstMile, as long as the request loosely relates to authorized store shipping-label or binding tasks. Overly broad routing increases the chance that the wrong skill handles a request and gains access to store-linked operations, files, or API calls that the user did not intend to invoke.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it always persists full API responses to disk but does not pair this with a prominent user-facing warning about the sensitivity of store, order, tracking, or document data being retained locally. Persistent storage of raw responses increases the risk of accidental disclosure through shared workspaces, backups, later tool access, or forensic recovery.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to always save full API responses and, for smaller payloads or when forced inline, print complete JSON to stdout. In this context, Shopee FirstMile responses can plausibly contain order identifiers, tracking numbers, addresses, warehouse details, and other operational data, so unconditional logging and natural-language surfacing materially increase the risk of sensitive-data exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document contradicts itself by stating both that the tool consumes compute resources and that it does not consume compute resources. Security-relevant operational contradictions can mislead users into approving repeated calls, retries, or data pulls they would otherwise avoid, and they undermine informed consent around cost and side effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 73)May include surrounding context.

---

curl 示例

bash

curl -X POST ${LINKFOX_TOOL_GATEWAY}/shopee/developerProxy \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s instructional content and field descriptions are presented entirely in Chinese, while no opt-in, alternative language option, or region-specific justification is provided. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation exposes a bulk-destructive operation ('unbind all orders from tracking number') without any warning, confirmation requirement, or guidance on safe use. In an agent setting, this increases the chance that the tool is invoked automatically or by a misunderstood user request, causing unintended operational changes across multiple orders.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation exposes an unbind operation that can sever the association between orders and first-mile tracking numbers, but it provides no warning, confirmation guidance, or operational safeguards for a destructive action. In an agent context, this increases the chance that a user or downstream automation invokes the endpoint casually or by mistake, causing shipment workflow disruption and requiring manual recovery.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file introduces authentication, account registration, and billing/payment recovery flows that are unrelated to a Shopee FirstMile logistics integration. This expands the skill’s operational scope into sensitive account onboarding and monetization handling, creating an opportunity for credential collection, social-engineering, and off-purpose data handling that users would not reasonably expect from this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the user to provide a phone number for script-driven registration/login without any privacy disclosure, data-handling warning, or verification that the flow is legitimate. That creates a social-engineering pattern where users may disclose personal contact information and authentication artifacts to an untrusted or minimally explained process.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup steps instruct users to persist an API key in shell startup files and environment variables without warning that the key is sensitive or discussing safer storage options. While common operationally, embedding this in a skill without security guidance can lead to credential exposure through shared shells, dotfile syncing, terminal history, or accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs a network call and may transmit identifiers, query parameters, and POST bodies via developerProxy, but the file provides no confirmation prompt, user-facing log/print, or explanatory comment beyond a brief module docstring. For a generic 'run any ... API' helper, that lack of disclosure means users may not realize their supplied data is being sent to an external service.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_shopee_first_mile_common.py (reported line 37)May include surrounding context.

python

print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr)
        sys.exit(DEPENDENCY_EXIT_CODE)
    try:
        result = subprocess.run(
            [sys.executable, str(checker)],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The helper transmits request bodies together with session/app metadata to a remote gateway without any visible user-facing notice in this code path. In the context of Shopee store operations, those payloads can contain commercially sensitive order and logistics information, making undisclosed transmission materially risky from a privacy and trust standpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.