Shopee-店铺全球商品

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:51 PM UTC
• Version: 1.0.5

Overview

This skill is mainly a Shopee product-management tool, but it also handles sensitive login, billing, live store changes, and broad local logging without enough safety controls.

Review before installing. Use only in an isolated workspace with trusted environment variables, verify LinkFox endpoint variables are not overridden, avoid sharing API-key or OTP output in logs, and require explicit human confirmation before any delete, publish, price, stock, sync, billing, or payment action. Treat the local linkfox output directory as sensitive business data and clean it up when no longer needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material such as access tokens, API keys, phone numbers, SMS codes, and group identifiers to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to an attacker-controlled host and exfiltrate credentials or intercept login and payment flows.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway request path uses a URL derived from environment variables and attaches the LinkFox API key in the Authorization header before calling urlopen. This means a poisoned runtime environment can cause authenticated requests to be sent to an attacker-controlled server, exposing the API key and enabling unauthorized use of the linked account.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises operational capabilities including environment-variable access, file writes, network access, and shell execution, but does not declare permissions or present clear least-privilege boundaries. That makes it harder for users and hosting platforms to understand the real trust surface, increasing the chance of silent data access, command execution, or unintended side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is described as a Shopee GlobalProduct proxy, but the referenced onboarding flow introduces account-login, SMS verification, API-key generation, account lookup, subscription purchase, and payment operations unrelated to the stated business function. This expands the trust boundary into authentication and billing workflows, creating risk of credential handling, account abuse, or unauthorized financial actions without clear user expectation.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper persistently saves full API responses to local disk, even though Shopee GlobalProduct operations can include sensitive business data and potentially authentication-related material returned by upstream services. Writing complete responses without minimization, redaction, or explicit consent creates a durable data exposure surface beyond the skill's stated proxying purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code creates a reusable local session archive and index of interactions under multiple filesystem locations, expanding the skill from transient API proxying into local data retention. This increases the blast radius of any compromise of the host, shared workspace, or later processes that can read these archives.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements a broad LinkFox onboarding and monetization CLI rather than Shopee GlobalProduct functionality described by the skill metadata. That mismatch is dangerous because users may invoke the skill expecting Shopee product operations, while the embedded code instead collects login credentials, acquires API keys, and drives billing-related actions.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: Billing and order-creation capabilities are outside the stated purpose of a Shopee GlobalProduct management skill and create unnecessary financial risk. A user or downstream agent could be induced to create payable orders and payment QR codes under misleading context, increasing the chance of unauthorized or confusing charges.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code performs account authentication, team discovery, and API token generation unrelated to Shopee GlobalProduct API forwarding. In this context, that broader access is risky because it enables credential collection and privilege acquisition that exceed what users would reasonably expect from a product-management skill.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger condition is broad enough to activate on loosely related Shopee merchant discussions, including cases where the user did not explicitly ask for global-product actions. Because the skill supports state-changing operations like publish, delete, price, and stock updates, over-triggering increases the chance of unintended API calls against a merchant account.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill exposes destructive and state-changing operations such as delete, publish, price updates, stock updates, and sync changes without a prominent warning or confirmation requirement. In a commerce context, accidental execution can directly alter inventory, pricing, or listing visibility across sites, causing operational and financial harm.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation exposes destructive inventory-management capabilities such as deleting global items/models without any cautionary language, confirmation requirements, or operator-safety guidance. In an agent skill context, this increases the chance that an automated workflow or user prompt could trigger irreversible store-data changes without the user appreciating the risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents update_price and update_stock as routine operations but omits warnings that they directly affect live product pricing and inventory, which can cause business loss, overselling, or accidental underpricing if invoked incorrectly. Because this skill is designed for agent-triggered commerce actions, missing safety guidance materially raises misuse risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The publish-task section describes APIs that can push global products to shops/sites without any warning that publication can expose listings to customers across storefronts. In this skill’s cross-border publishing context, accidental or unauthorized use could rapidly create unwanted live listings, synchronization changes, or marketplace compliance issues across multiple shops.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation exposes a destructive API operation that permanently deletes a global item, but it does not warn about irreversibility, confirmation requirements, or operational safeguards. In an agent skill context, this increases the chance that an automated workflow or user will invoke deletion unintentionally, especially because the examples show a direct runnable command without any cautionary language.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation exposes a destructive API operation that deletes a global SKU model but does not include any cautionary note, confirmation requirement, rollback warning, or guidance on validating identifiers before execution. In an agent skill context, terse operational docs can directly drive automated actions, so the absence of safety guardrails increases the chance of accidental or overly broad deletion of production catalog data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This documentation exposes a price-affecting write operation (`update_local_adjustment_rate`) but does not warn that invoking it modifies live business pricing configuration. In an agent/tooling context, missing mutation warnings increases the chance that a user or downstream agent triggers a state-changing action unintentionally, causing incorrect local pricing across markets and financial loss.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This documentation describes a live inventory-changing operation (`update_stock`) but does not prominently warn that it modifies production stock levels for a merchant's global products. In an agent/automation context, that omission can cause accidental execution, mis-scoped updates, or unsafe user confirmation flows, leading to overselling, delisting, or business disruption across markets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions direct an operator to handle a user's phone number and one-time verification code through a local script, but provide no privacy notice, consent guidance, masking requirements, or safe handling constraints. This creates a real risk of unnecessary collection, exposure, or retention of sensitive authentication data by intermediaries, especially because OTPs can directly enable account access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to persist API keys in shell profile files and immediately source them, but does not warn that this stores secrets in plaintext in long-lived local configuration that may be readable by other tools, backups, shell history workflows, or later disclosed during troubleshooting. While common operationally, embedding secret-handling commands without safety guidance is a real secret-management weakness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: API responses are written to disk automatically with no user-facing warning, confirmation, or control. In this skill context, responses may contain product catalogs, merchant identifiers, pricing, stock, publication task data, and possibly proxied error payloads, making silent persistence a meaningful confidentiality risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The login command emits the retrieved API key directly to stdout JSON, which is commonly captured by agent logs, shells, transcripts, CI systems, or other tooling. Exposing long-lived credentials this way can lead to credential leakage and subsequent unauthorized API access.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instructions require every API response to be written to a session-linked local file and sometimes fully printed to stdout. GlobalProduct responses can include merchant identifiers, item metadata, pricing, stock, and other business-sensitive data; persisting and echoing that data outside the immediate need increases exposure through logs, shared workspaces, or later accidental disclosure.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The result-emission path both persists full responses and may print them inline, creating two separate leakage channels for sensitive data. Because this module fronts a developer proxy and token-resolution flow, upstream responses could include merchant data, internal errors, or tokens/access credentials that should never be exposed in logs or terminal output.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This outbound transmission is security-relevant because the destination URL may be environment-controlled and the payloads include sensitive login and token data. In the context of a mismatched Shopee skill, transmitting those secrets to configurable external endpoints materially raises the risk of covert credential exfiltration.

Static analysis

No suspicious patterns detected.