Shopee-店铺媒体空间

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.5

Overview

This Shopee upload skill includes real upload helpers, but it also bundles account login, API-key generation, payment ordering, and persistent response logging that need review before installation.

Review this skill before installing. Use it only if you are comfortable with LinkFox handling Shopee media uploads, local storage of full API responses, and the separate onboarding flow for phone/SMS login, API-key creation, and paid credit purchases. Do not provide verification codes or create orders unless you intentionally want those account and billing actions, and avoid custom endpoint environment variables unless you control and trust the destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends login, token, and account data via requests.post. If an attacker can influence those environment variables, they can redirect sensitive authentication traffic and harvested API material to an attacker-controlled endpoint, making this an SSRF/exfiltration vector.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway helper sends authenticated requests with the LINKFOX agent API key to a URL derived from environment-controlled base settings using urlopen. An attacker who can alter the environment can redirect these requests and capture Authorization headers or trigger requests to unintended internal/external services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet the documentation explicitly describes use of environment variables, shell scripts, network access to `/shopee/developerProxy`, and file writes to the working directory. This hidden capability expansion weakens review and consent boundaries, making it easier for an agent or operator to invoke sensitive behaviors without clear permission scoping.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is Shopee media upload, but the actual behavior reportedly includes LinkFox account login, API key generation, billing, order creation, payment status checks, and QR code rendering. That is a major scope expansion into authentication and financial operations, which can expose users to account takeover, unauthorized purchases, or covert monetization if the skill is triggered under the guise of media upload.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation says the tool consumes credits and warns against repeated retries, but later states '不消耗积分' (does not consume credits). Contradictory billing semantics can mislead users and agents into performing extra calls or approval decisions they would not otherwise make, creating financial and trust risk.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper writes full API responses to persistent local storage under linkfox/<date>/<session>/data and may also print them inline. For a MediaSpace/auth-adjacent skill, those responses can include shop identifiers, uploaded media metadata, URLs, error details, and potentially sensitive proxy-returned content, creating unnecessary data retention and local disclosure risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a LinkFox onboarding, login, token acquisition, subscription, and payment workflow that is unrelated to the declared Shopee MediaSpace upload capability. Such a capability mismatch is dangerous because it expands the skill into credential collection and monetization paths users would not expect, increasing the chance of secret harvesting and deceptive behavior.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can list packages, create orders, and render payment QR codes, which has no justified relationship to Shopee media upload. Embedding billing flows inside an unrelated skill creates a strong risk of deceptive monetization and unauthorized purchase initiation under a misleading capability label.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The module performs SMS login, token-based account bootstrap, team discovery, and API key generation for LinkFox accounts despite claiming to be a Shopee upload skill. This is dangerous because it collects authentication factors and provisions long-lived credentials outside the declared purpose, enabling account takeover or stealthy credential harvesting.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file’s own docstring explicitly describes a LinkFox onboarding CLI, contradicting the skill metadata that promises Shopee MediaSpace upload behavior. This mismatch is a red flag for deceptive packaging because users and reviewers may authorize one purpose while the code executes another.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to activate on general Shopee image/video discussions, even when the user did not clearly request this specific upload skill. Over-broad activation increases the chance of unintended network calls, file writes, or interaction with authorized stores in the wrong context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions direct users to provide a phone number to a script-mediated registration flow and to process verification codes, but they do not disclose how that personal data is handled, stored, transmitted, or retained. This creates a privacy and consent risk, especially because the skill encourages collection of sensitive account-recovery information during error handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The billing instructions tell the operator to create orders and present payment URLs or QR codes without a prominent user confirmation or warning that this can trigger real charges. In a conversational agent context, this increases the risk of accidental purchases, social engineering, or misleading users into paying without informed consent.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The code comments and implementation establish a behavior of persisting complete responses and later summarizing or exposing them. In a proxy/helper that handles authenticated Shopee API interactions, this creates a meaningful chance of storing or revealing sensitive operational data beyond the user's immediate need.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 82% confidence
• Finding: This code transmits user authentication and account-related data to external network endpoints. External transmission is especially risky here because the destinations are environment-configurable and the transmitted content includes login and token material, so it materially increases exfiltration risk in the context of an unrelated Shopee skill.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 88% confidence
• Finding: The alternate environment variable path provides another route for the skill to ingest LinkFox agent API credentials. Given the broader undeclared login, order, and token-management behavior in this file, this secret harvesting capability increases the blast radius if the skill is abused or misconfigured.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 88% confidence
• Finding: The alternate environment variable path provides another route for the skill to ingest LinkFox agent API credentials. Given the broader undeclared login, order, and token-management behavior in this file, this secret harvesting capability increases the blast radius if the skill is abused or misconfigured.

Static analysis

No suspicious patterns detected.