Shopee-店铺物流

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.6

Overview

This skill mostly implements Shopee logistics, but it needs Review because it also handles credentials and billing, stores sensitive logistics data locally, allows endpoint overrides, and asks the agent to send automatic feedback to LinkFox.

Install only if you are comfortable giving this skill access to live Shopee logistics actions and LinkFox account credentials. Before use, verify all LINKFOX_* gateway URL environment variables point to trusted LinkFox HTTPS domains, avoid sharing SMS codes or API keys in agent-visible transcripts, require explicit confirmation before shipping, deleting, or pausing anything, and periodically delete or protect the local linkfox response files that may contain customer or store data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:155

Finding

Automatic Third-Party Feedback Reporting Without Explicit User Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_logistics_common.py:179

Finding

Unsafe Persistent Storage of Complete Logistics Responses

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` ```python def _lf_session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, ...[truncated 3140 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:468

Finding

Generated API Key Is Exposed Through Standard Output

Content

View full analysis

dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: invalid phone format: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: invalid verification-code format: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token(lg["access_token"], lg["user_id"], info["group_id"]) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key acquired successfully", file=sys.stderr) return 0 return 1 ``` The source implementation returns the generated `api_key` in the result object and then serializes that object directly to stdout. ### Tech ...[truncated 1756 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_logistics_common.py:17

Finding

Environment-Controlled Gateway URLs Can Redirect Credentials and Logistics Data

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else "" return {"error": f"HTTP {e.code}: {e.reason}", "details": body} except URLError as e: return {"error": f"Connection failed: {e.reason}"} ``` The onboarding implementation uses the same pattern: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) ``` ```python def _gateway(method: str, path: str, body: dict | None = None) -> dict: url = f"{_agent_base()}{path}" body_bytes = json.dumps(body or {}).e ...[truncated 2390 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (76)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination and several outbound headers are influenced by environment variables, including the base URL and session/message metadata, and the Authorization API key is always sent to that destination. If an attacker can control LINKFOX_TOOL_GATEWAY/SHOPEE_API_BASE_URL or the runtime environment, they can redirect traffic and exfiltrate credentials and sensitive store data to an arbitrary server.

Content

Scanner excerpt · scripts/_shopee_logistics_common.py (reported line 88)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code allows base URLs for login and agent-user API calls to be overridden via environment variables, then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs. If an attacker can influence the runtime environment, they can redirect requests to attacker-controlled endpoints and exfiltrate credentials or impersonation tokens; this is especially dangerous because the file performs account login and token issuance flows.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway URL is derived from environment variables and used in urllib requests carrying the Authorization API key header and business actions such as account lookup, plan retrieval, and order creation. An attacker who can set the environment can redirect these authenticated requests to a malicious server, stealing the API key and capturing or manipulating purchase/order traffic.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description claims this skill handles Shopee logistics and forwards a full set of Shopee Open API Logistics endpoints. However, the provided code chunk does not perform any logistics operations at all. It neither calls /shopee/developerProxy nor implements any endpoint wrappers like ship_order, get_tracking_number, or shipping-document functions. Its sole purpose is to detect whether the authentication dependency skill is installed by scanning environment-configured and common local skill directories. This is a materially different primary purpose from the declared logistics functionality, so the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about Shopee logistics and fulfillment operations for authorized Shopee stores, specifically forwarding Shopee Open API Logistics endpoints. The supplied code does none of that. There are no Shopee endpoints, no developerProxy usage, no logistics/shipping operations, no order fulfillment actions, no tracking or shipping document handling. Instead, the code is a standalone LinkFox onboarding CLI centered on phone-based authentication, account/team lookup, API token generation, subscription/package purchase, payment QR generation, and order status checks. This is a materially different primary purpose and accesses entirely different services/resources, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements LinkFox onboarding, SMS login, API-key issuance, subscription browsing, order creation, and payment QR generation, which is materially unrelated to the declared Shopee logistics purpose. The mismatch increases risk because a user invoking a Shopee shipping skill would instead be funneled into account bootstrap and monetization flows that can collect credentials and trigger external payments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code contains explicit account provisioning and billing behavior, including API token generation and paid order flows, despite the skill being described as a Shopee logistics tool. In context, this unjustified capability expansion is dangerous because it can coerce users into revealing login codes and purchasing services unrelated to the requested logistics task.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities that include environment access, file writing, network access, and shell execution, but does not define an explicit tool scope or permission boundary. In a skill that can touch store logistics and local files, the lack of least-privilege constraints increases the risk of unintended data access, persistence, or command execution if the implementation or future revisions are abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are very broad and activate even when users do not explicitly mention logistics, as long as a message is interpreted as related to shipping or tracking. Overbroad activation can cause the wrong skill to run on sensitive commerce conversations, increasing the chance of unintended API calls, data disclosure, or writes to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs that full API responses should always be written persistently to local files. Logistics responses can contain tracking numbers, addresses, recipient details, shop identifiers, and other operational data, so unconditional persistence increases exposure and retention risk beyond the immediate task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Always persisting complete API responses into session-scoped local files can retain sensitive store and customer logistics data such as addresses, phone numbers, tracking details, and shipping documents. Because the retention is automatic and tied to the working directory, other tools, users, or later tasks may access that data unintentionally, making the skill context more dangerous than a transient in-memory workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This documentation exposes a broad set of state-changing logistics operations, including shipping orders, updating addresses, deleting configuration, and downloading shipping documents, but does not clearly warn that these actions can modify live store state or disclose sensitive business/customer data. In an agent skill context, missing guardrails increases the chance that an LLM or user invokes destructive or privacy-impacting actions without confirmation or scope validation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 125)May include surrounding context.

---

curl 示例

bash

export KEY=$LINKFOX_AGENT_API_KEY

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s instructional content and headings are presented only in Chinese, which effectively forces a specific language for users of the skill. The policy allows fixed-language behavior only when user choice is offered or the locale restriction is explicitly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file presents key usage instructions and parameter explanations in Chinese, with no indication that the user may choose another language and no documented justification for a locale-specific restriction. The policy requires avoiding forced language or locale constraints unless the skill offers opt-in or clearly states a justified regional scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes this skill as handling Shopee logistics/shipping operations such as shipping parameters, shipping documents, tracking, channel lists, and READY_TO_SHIP fulfillment. This file documents a delete_address capability that deletes an address, which is not mentioned in the manifest description and is not an obvious fit for the listed shipping-document/tracking-focused examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document exposes a destructive delete operation with no warning about irreversibility, required identifiers, or user-confirmation safeguards. In an agent setting, this increases the risk of accidental or prompt-induced deletion of shipping addresses, which can disrupt fulfillment operations and be abused for operational sabotage if the agent invokes it without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation exposes a destructive delete operation ('delete_special_operating_hour') but does not warn that it removes scheduling data or recommend confirmation before execution. In a logistics skill that operates on authorized Shopee stores, this increases the chance of accidental or socially engineered deletion of store operating-hour configuration, which can disrupt fulfillment workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This documentation exposes a batch shipment operation that can change many orders to a shipped state, but it does not warn users that the action may be irreversible or operationally sensitive. In the context of a logistics skill that targets authorized Shopee stores and supports mass shipping, missing safety guidance increases the risk of accidental bulk fulfillment, incorrect tracking creation, and downstream business/customer impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This documentation exposes a state-changing logistics API that can pause shipping operations, but it does not warn users that invoking it alters operational state and may disrupt fulfillment. In an agent context, insufficient emphasis on side effects increases the chance of accidental invocation or socially engineered misuse against an authorized shop.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation exposes a real-world order-shipment action ('ship_order') and explicitly instructs callers to pass through the full request body, but it provides no warning that invoking this endpoint can trigger irreversible fulfillment operations in Shopee. In an agent setting, that omission increases the chance that the model or user invokes the action casually or with incomplete confirmation, causing unintended shipment, label generation, or downstream logistics state changes for a live store.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation content and field descriptions are written in Chinese throughout the main usage section, with no indication that the skill supports other languages or that Chinese is a documented regional requirement. This creates a natural-language locale constraint that can violate organizational language-choice policies when users are not given an explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation is written in Chinese for headings, field descriptions, and usage notes, with no indication that users may choose another language or that the skill is intended only for a Chinese-language audience. This can violate a language/locale policy when skills impose a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The onboarding instructions explicitly tell the operator to collect a user's phone number and pass it to a local script for registration, but provide no privacy notice, consent guidance, retention limits, or data-handling constraints. In an agent-skill context, this increases the chance that sensitive personal data is solicited and processed in an ad hoc way, which can expose users to privacy violations, regulatory risk, or mishandling of SMS-based authentication data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.