Shopee-店铺物流

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:52 PM UTC
• Version: 1.0.5

Overview

This looks like a real Shopee logistics skill, but it also includes sensitive account, API-key, payment, and data-retention behavior that deserves manual review before installation.

Install only if you trust LinkFox and intend to let the agent perform live Shopee logistics actions. Configure API keys and gateway URLs carefully, avoid using the built-in phone-login/payment helpers unless you explicitly want the agent to handle account setup or purchases, confirm all shipment/address changes before running scripts, and periodically delete the local linkfox response files if they may contain customer or order data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The POST target is derived from environment-controlled base URLs and the request carries sensitive authentication material such as access tokens, uid/tid headers, and user phone/login data. If an attacker can influence environment variables or deployment configuration, they can redirect these requests to an attacker-controlled endpoint and exfiltrate credentials and account data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: The urllib request URL is also built from environment-controlled base configuration and includes the LinkFox API key in the Authorization header. A compromised or misconfigured environment can therefore cause the CLI to send API keys and account/order operations to an arbitrary remote host, creating a direct credential exfiltration path.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while its documented behavior uses environment variables, shell/Python execution, filesystem writes, and network access. This undermines least-privilege review because operators and users cannot accurately assess what the skill can access or modify before activation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented purpose is Shopee logistics, but the skill also appears to include account-login, API-key generation, subscription, and payment-order capabilities for LinkFox. That is a material scope expansion into authentication and billing flows, which could be abused to trigger sensitive account actions unrelated to the user's logistics request.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The file first warns that operations consume credits and should not be retried automatically, then later states '不消耗积分' (does not consume credits). Contradictory cost semantics can cause an agent or user to make unintended repeated calls, potentially causing financial loss, quota exhaustion, or unsafe automation decisions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file documents an `update_tracking_status` Shopee Logistics endpoint even though the skill metadata claims coverage of a fixed set of 46 Logistics interfaces and this endpoint is flagged as outside that declared set. A mismatch between declared capability and actually documented/exposed API surface can lead to unauthorized or unexpected operations being available through the agent, weakening review, allowlisting, and user expectations about what actions the skill can perform.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper persistently writes full API responses to local disk, and this skill handles Shopee logistics data plus developerProxy responses that may include shipping details, tracking data, identifiers, and potentially tokens or other sensitive fields. Because the logging is automatic and undisclosed in this file, sensitive merchant/customer data may be retained on disk longer than necessary and exposed to other local processes or future sessions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key issuance, plan listing, ordering, and payment handling, which is unrelated to the stated Shopee logistics skill purpose. Such capability drift is dangerous because it expands the skill into credential acquisition and billing actions that users would not reasonably expect from a logistics proxy.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes for subscription purchases, which is not justified by Shopee logistics operations like shipping, tracking, or label generation. Embedding purchase flows in an unrelated skill increases the risk of deceptive billing, unauthorized purchases, and abuse of user trust.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can retrieve or generate LinkFox API tokens after SMS login, exceeding the minimum capability required for a Shopee logistics proxy. This creates a sensitive credential minting path inside an unrelated skill, enabling privilege expansion and long-lived access beyond the immediate user task.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger logic is overly broad and instructs activation even when the user does not explicitly mention logistics, as long as the topic vaguely involves shipping, labels, or tracking for an authorized shop. Broad auto-triggering increases the chance of unintended invocation of a networked skill that can perform operational actions like shipping orders or fetching sensitive logistics data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that complete responses are always written to disk and may be fully printed to stdout, but the description and trigger text do not prominently warn users before handling potentially sensitive shipping, address, tracking, and order data. This creates a transparency and privacy risk because users may invoke the skill without realizing their data will be persistently stored locally.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation exposes a live batch shipment operation for Shopee orders but does not warn that invoking it may irreversibly transition multiple orders into a shipped state. In an agent-driven environment, vague triggering conditions and example commands can cause accidental execution against production stores, leading to operational errors, premature fulfillment, and downstream customer or financial impact.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes an operation that creates shipping labels/documents but does not warn that this may have operational or partially irreversible effects in a live commerce workflow, such as consuming logistics resources, advancing fulfillment state, or generating carrier artifacts. In this skill context, users are interacting with authorized Shopee stores via a proxy, so ambiguous or incomplete safety guidance increases the chance of accidental real-world actions against production shop data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file documents a destructive delete-address operation with example invocation but provides no warning, confirmation guidance, or statement about irreversible operational impact. In an agent setting, this increases the chance that a model or user triggers deletion casually or through misunderstanding, potentially removing pickup/return addresses and disrupting fulfillment workflows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation exposes a high-impact operational action (`ship_order`) and explicitly instructs callers to pass the full body, but it does not warn that shipping an order can trigger real fulfillment state changes that may be hard or impossible to reverse. In an agent skill context, sparse guardrails increase the chance of accidental shipment, misuse of the wrong shop context, or execution without explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding flow explicitly asks the user to provide a phone number and then uses it in scripted registration, but the document provides no privacy notice, retention limits, consent language, or warning about how that personal data will be handled. In a support/onboarding context this increases the risk of unnecessary collection or mishandling of personal data, especially because the agent is instructed to solicit the number directly from the user.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The developer proxy helper can forward arbitrary request bodies, query strings, and an access token to an external proxy endpoint, creating a concentrated path for sensitive data exfiltration or misuse if upstream callers are compromised or if the proxy endpoint is changed. In the context of a logistics forwarding skill, this is especially sensitive because it can transmit authenticated API requests on behalf of merchants.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Writing full API responses to disk without warning creates undisclosed local persistence of potentially sensitive logistics and merchant data. Since this helper is shared and automatic, callers may unknowingly cause personal or business information to be retained in predictable filesystem locations, increasing exposure from local compromise or accidental collection.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The CLI emits a newly obtained API key directly to stdout JSON, which may be captured by logs, transcripts, shell history wrappers, orchestration systems, or downstream tools. Exposing sensitive credentials in normal output materially increases accidental leakage risk, especially in agent environments where outputs are persisted.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This script directly invokes the Shopee `ship_order` logistics action with attacker- or user-supplied JSON and immediately executes the shipping request, with no built-in confirmation, preview, or safeguard in the entrypoint. In the context of a fulfillment skill, this can cause unintended order shipment, label generation, or downstream logistics side effects if triggered accidentally or through prompt/parameter manipulation upstream.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Persistently storing full API responses and sometimes emitting the full JSON to stdout can expose personally identifiable and operationally sensitive data such as names, addresses, phone numbers, tracking numbers, labels, and shop/order metadata. In shared workspaces, logs, terminals, or repositories, this can lead to unauthorized disclosure beyond the intended user session.

Static analysis

No suspicious patterns detected.