Shopee-店铺媒体

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.5

Overview

The skill’s media-upload function is coherent, but it also includes account login, API-key creation, and payment-order workflows that warrant Review before installation.

Install only if you expect this media skill to also help with LinkFox account onboarding and billing. Prefer the self-service LinkFox key flow where possible, treat the API key and SMS code as secrets, verify no LINKFOX_* base-url environment variables point to untrusted hosts, and keep the generated linkfox response directories out of shared repos or backups unless you intend to retain that data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, and this function sends authentication material and user data to that destination. If an attacker can influence environment variables in the skill runtime, they can redirect login or token traffic to an attacker-controlled server and exfiltrate SMS codes, access tokens, refresh tokens, and generated API keys.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request URL is also built from environment-controlled base configuration and is used with the Authorization header containing the LinkFox API key. A hostile runtime or wrapper could redirect these requests to an attacker-controlled endpoint and capture API keys, order/payment metadata, and other account information.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable capabilities including environment access, file writes, shell, and network use, but does not declare permissions or provide an explicit trust boundary for those operations. In practice this increases the chance that a caller unknowingly authorizes sensitive actions such as reading API keys from the environment and writing data into the working directory, which is especially risky for an agent skill that proxies external APIs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: A media-upload skill that also contains flows for SMS login, API key generation, account queries, plan purchase, payment order creation, payment status checks, and QR-code rendering is a strong scope-creep red flag. These hidden capabilities materially expand the attack surface from simple media proxying into account access and billing actions, creating risk of unauthorized authentication, account takeover assistance, or financial abuse if the extra behaviors are triggered.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The shared helper persistently writes full API responses plus session metadata to local disk under predictable directories, even though the skill is described as a Shopee media proxy/upload tool. Media API responses may contain shop identifiers, upload IDs, URLs, tokens, or other sensitive business data, and silently retaining them expands exposure far beyond the declared function of the skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a full onboarding, login, API-key issuance, package listing, ordering, and payment workflow that is unrelated to the declared Shopee media-upload skill. That mismatch is dangerous because it expands the skill's effective privileges into credential collection and commerce flows users would not reasonably expect from a media proxy integration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Order creation, payment QR generation, and order-status querying are commerce capabilities unrelated to Shopee media upload. In this context, such features create an unjustified path to induce purchases or handle payment artifacts inside a skill that should only proxy media APIs.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can fetch or generate LinkFox API tokens after SMS login, which is a credential-minting capability far beyond the declared media-upload purpose. In a skill context, this enables account takeover of the user's agent environment or unauthorized access to other APIs once the token is obtained.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill states that complete API responses are always written under the current project directory, but this persistence behavior is not surfaced as a prominent user warning despite potentially storing sensitive business data, media metadata, identifiers, and API responses on disk. In shared workspaces or repositories, these files may be unintentionally exposed, committed, or read by other tools.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions direct the agent to collect a user's phone number and use a local script to send verification codes and log in on the user's behalf, but they provide no privacy notice, consent language, retention limits, or guidance on how that personal data is handled. This creates unnecessary exposure of sensitive personal data and OTP-based account access flows, increasing the risk of privacy violations, mishandling, or credential compromise.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to persist an API key in shell startup files and environment variables without warning that the key is a secret or that shell profiles may be readable, backed up, synced, or exposed to other local processes. While not inherently malicious, this guidance can cause credential leakage or overly broad long-term exposure if users store production secrets insecurely.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: API responses are saved to disk automatically without user-facing warning, confirmation, or indication of what data will be retained. In the context of a media-upload skill, this covert persistence can expose sensitive response bodies and create compliance, privacy, and credential-handling risks if the host is shared or later compromised.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The CLI logs JWT-derived identity fields such as uid and name to stderr. In hosted agent environments, stderr may be captured centrally, exposing user identifiers to logs or operators without clear disclosure or necessity.

Static analysis

No suspicious patterns detected.