Shopee-店铺直播

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:48 PM UTC
• Version: 1.0.5

Overview

This skill is mostly a disclosed Shopee livestream API integration, but it also handles phone/SMS login, API key generation, billing orders, payment QR codes, and persistent local response storage in ways users should review carefully.

Install only if you are comfortable letting this skill manage real Shopee livestream operations and LinkFox account/billing setup. Avoid giving SMS codes or approving payment/order commands unless you explicitly initiated that flow, protect any API key printed by the tool, and review or clean the local linkfox response files because they may contain shop or livestream data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, and this helper is used to send sensitive onboarding data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens. In an agent/skill environment, allowing unvalidated environment overrides can redirect those secrets to an attacker-controlled host, creating a credential exfiltration path.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The gateway request path ultimately uses a URL built from environment-controlled base configuration and includes the Authorization header from LINKFOX_AGENT_API_KEY. If an attacker can influence the environment, requests can be redirected to a malicious server and the API key disclosed via outbound HTTP headers.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises substantial capabilities including environment-variable access, file writes, shell/script execution, network access, and proxying through an MCP/backend endpoint, yet no explicit permissions are declared. This weakens reviewability and user consent because a caller may invoke a skill that can write data locally, read secrets from the environment, and make outbound requests without a clear permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is Shopee livestream management, but the referenced onboarding flow includes account registration, SMS verification, API-key acquisition, plan/package browsing, order creation, payment QR rendering, and payment-status querying. That is a significant scope expansion into identity, billing, and payments, which can surprise users and enable unintended financial or account actions under the guise of a livestream tool.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The document says the tool consumes credits and warns against repeated attempts due to cost, but later states '不消耗积分' (does not consume credits). Contradictory billing semantics are dangerous because they can mislead users or downstream agents into making repeated calls, onboarding for payment unnecessarily, or authorizing operations without understanding financial consequences.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The onboarding document introduces authentication recovery, phone-based registration, API key setup, and billing/payment flows that are not necessary for a Shopee Livestream management skill. This expands the skill's operational scope into account onboarding and monetization, creating unnecessary access to sensitive data and opportunities for user redirection, social engineering, or unauthorized account actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The instructions direct the agent to collect a user's phone number, send verification codes, log in on the user's behalf, and initiate plan purchases, none of which are justified by a Livestream management skill. In this context, these capabilities are dangerous because they enable handling of personal data and financial actions far beyond the minimum needed for Shopee livestream operations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper persistently writes full API responses to local files under a session directory, even though the skill is described as an API proxy for Shopee livestream operations. Livestream API responses can contain shop identifiers, comments, image references, metrics, and potentially tokens or other sensitive business data, so silent persistence creates unnecessary data exposure on the host.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This block creates and manages a local workspace/session logging structure unrelated to the core function of forwarding Shopee livestream API calls. Such logging can accumulate sensitive operational metadata across sessions, increasing the chance of unintended disclosure from shared workspaces, backups, or local compromise.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, token minting, package browsing, and payment flows, which are unrelated to the stated Shopee Livestream skill purpose. That scope mismatch is dangerous because it expands the skill into credential collection and monetization behavior users would not reasonably expect from a Shopee livestream management integration.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can create orders, generate payment QR codes, and query payment state despite the skill being described as a Shopee livestream API forwarder. Unrelated payment capabilities materially increase risk of unauthorized purchases, social engineering, or abuse of the host environment for billing actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section performs SMS-based login, account linkage, user/team discovery, and API-token retrieval/generation for LinkFox accounts, all unrelated to Shopee livestream forwarding. In context, this is a covert credential and token provisioning workflow embedded in an unrelated skill, which is especially risky because it can obtain long-lived API access.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger rule explicitly says the skill should activate even when the user does not mention 'livestream' as long as the request relates to management of an authorized Shopee store's sessions/items/interactions. This is overly broad and increases the chance of accidental invocation for generic store-management tasks, which is riskier here because the skill can perform state-changing API calls, write files, and potentially initiate onboarding/payment flows.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation includes curl examples that transmit sensitive values such as an Authorization header, accessToken, and shopId over the network, but it does not warn readers that these are secrets, should only be used over trusted HTTPS endpoints, and must never be logged, shared, or hardcoded. In an agent-skill context, users may copy these examples directly into scripts, terminals, tickets, or chat, increasing the chance of credential leakage and unauthorized access to Shopee shop operations.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This documentation exposes a moderation endpoint that bans users from commenting but provides no warning, authorization guidance, audit expectations, or abuse considerations. In an agent-skill context, that omission is risky because the agent may treat the action as a routine API call and perform punitive moderation without explicit user confirmation or adequate safeguards.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation exposes a destructive API operation that removes items from a livestream but does not include any caution, confirmation expectations, or guidance to verify user intent before execution. In an agent skill context, this increases the risk of accidental or socially engineered destructive actions against a user's authorized Shopee store, especially because the skill is designed to trigger broadly for livestream management tasks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation exposes a destructive livestream operation ('Remove currently shown item') but provides no warning, confirmation requirement, or guidance to verify user intent before execution. In an agent skill context, this increases the risk that a natural-language request is translated into an irreversible or business-impacting action without sufficient friction, potentially disrupting an active livestream or removing the wrong promoted item.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes a destructive operation that ends a livestream session but does not warn the agent or user that the action may be disruptive, business-impacting, and difficult to reverse in practice. In an agent skill context, missing safety guidance increases the chance of accidental termination from ambiguous prompts or overly eager automation, especially because the skill is designed to trigger on livestream-management requests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs the agent to ask for a phone number and process login/registration actions, but provides no privacy notice, retention policy, or explanation of how the phone number and verification code will be handled. This creates a meaningful privacy and trust risk because users may disclose sensitive authentication data without informed consent or clear safeguards.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code writes API responses to disk automatically without any user-facing warning, consent, or indication that data will be retained locally. In a commerce-management skill, those responses may contain commercially sensitive or personal data, so undisclosed persistence materially increases privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The login flow returns the generated API key in stdout JSON, which is likely to be captured by agent logs, transcripts, shell history, or downstream tools. Exposing bearer credentials this way can lead to account compromise if any logging or observation path is accessible to other users or systems.

Static analysis

No suspicious patterns detected.