Security audit

Shopee店铺-关注有礼

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it needs review because it can change live Shopee promotions, handle login/API keys and payments, and save full business API responses locally.

Install only if you are comfortable giving this skill authority over real Shopee Follow Prize campaigns and LinkFox account billing flows. Before use, confirm every add, update, end, delete, login, API-key, and payment action explicitly, and treat saved linkfox session files, stdout logs, API keys, phone numbers, SMS codes, and QR files as sensitive data that may need cleanup.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared purpose is limited to Shopee Follow Prize management, but the broader behavior described by the finding includes login, API-key generation, account inspection, package purchasing, payment QR creation, and payment-status queries. That mismatch is dangerous because it can cause users or orchestration layers to authorize a seemingly narrow commerce-management skill that actually performs account and billing actions outside expected scope.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill says it consumes points in the cost-constraint section, but later states '不消耗积分' (does not consume points). Contradictory billing semantics are risky because they can mislead users and agents into making repeated calls, trigger unapproved spend, or suppress caution that should apply to metered operations.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: emit_result() serializes and writes full API responses to local disk under a session directory, even though the skill is described as an API-forwarding helper for Shopee Follow Prize management. Those responses may contain shop identifiers, campaign data, tokens, or other sensitive business data, creating unintended local persistence and expanding exposure beyond the remote API call itself.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This block adds generalized session tracking, directory discovery, metadata indexing, and filesystem persistence unrelated to the narrow purpose of managing Shopee Follow Prize campaigns. Such extra data-collection and persistence features increase the chance of sensitive operational data being retained locally and accessed by other users or processes on the host.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file implements SMS login, token acquisition, plan listing, order creation, and payment QR generation, which are unrelated to a Shopee Follow Prize management skill. This scope drift is dangerous because it introduces credential-handling and billing capabilities that users and reviewers would not expect from the declared skill, increasing phishing, secret exposure, and unauthorized commerce risk.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The operational behavior materially diverges from the manifest: instead of exposing Shopee Follow Prize APIs, the script authenticates LinkFox users and manages purchases. Such mismatch undermines trust and can enable deceptive collection of phone numbers, verification codes, and API keys under a false functional pretext.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger condition explicitly says the skill should activate even when '关注有礼' is not mentioned, as long as the conversation loosely involves authorized Shopee store Follow Prize management. Overly broad auto-invocation increases the chance of unintended execution against real stores, especially because the skill can modify, end, or delete campaigns through proxied API calls.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This documentation exposes a destructive delete capability for Follow Prize campaigns without any warning, confirmation guidance, or guardrails around irreversible actions. In an agent-driven context, that increases the chance of accidental deletion of live campaign data or user-request misinterpretation leading to unauthorized or unintended destructive changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation describes an irreversible operation that ends a live Follow Prize campaign early, but it provides no warning, confirmation requirement, or operator-safety guidance. In an agent context, that omission can cause accidental destructive actions against a merchant's store promotions, leading to business disruption and loss of campaign value.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The onboarding flow explicitly instructs the agent to collect a user's phone number and process login/registration codes, which are sensitive authentication-related data. Without clear privacy handling guidance, minimization rules, redaction requirements, or user-consent language, the skill increases the risk of unnecessary collection, disclosure, or mishandling of personal data and account access artifacts.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The helper writes complete API responses to disk and only prints that they were saved after the fact, without any explicit consent or warning before persistence. In this context, responses from store-management APIs can contain commercially sensitive or account-linked information, so silent local retention is a meaningful privacy and security issue.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script obtains or generates an API token and returns it in stdout JSON without an in-file warning or safeguards around credential sensitivity. In agent and CLI environments, stdout is often logged, captured, or surfaced to other components, so this can leak long-lived credentials beyond the immediate user session.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The code writes payment QR images into local session directories under workspace, home, or temp paths without explicit disclosure. While not severe by itself, it creates residual artifacts containing payment links that may be accessible to other local users, processes, or later sessions on shared systems.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to always persist full API responses in a session-linked directory and sometimes print complete JSON to stdout. Because Follow Prize and store-management responses may contain shop identifiers, campaign data, tokens-by-reference, or other sensitive business metadata, this creates avoidable retention and disclosure channels beyond the immediate task context.

Static analysis

No suspicious patterns detected.