Shopee-店铺商户

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:42 PM UTC
• Version: 1.0.5

Overview

The skill can perform Shopee merchant lookups, but it also includes account login, API-key generation, billing order creation, payment QR handling, and persistent local storage that need review before use.

Install only if you are comfortable with this skill handling LinkFox account onboarding, API-key setup, paid-plan ordering, and local storage of Shopee merchant data. Use it in a workspace where saved linkfox response files and QR images will not be synced or committed, and ensure LinkFox endpoint environment variables are not set to untrusted hosts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and the function sends login data, tokens, and other sensitive account material to that destination. In a skill/runtime environment where env vars can be influenced, this enables SSRF or exfiltration of SMS codes, access tokens, refresh tokens, and generated API keys to an attacker-controlled host.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL is also built from environment-controlled base URLs and is used with the Authorization header carrying the API key. If the runtime environment is tampered with, requests can be redirected to an attacker server, leaking API keys and enabling unauthorized API actions, while also creating SSRF-like outbound access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while explicitly directing use of environment variables, shell-executed Python scripts, network access to `/shopee/developerProxy`, and persistent file writes. This creates a transparency and governance gap: operators and users cannot accurately assess what the skill can access or modify, which weakens review controls and increases the chance of unsafe execution in sensitive workspaces.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is limited to Shopee merchant information queries, but the implementation reportedly also supports LinkFox account login, SMS verification, API key acquisition, package purchase, payment rendering, and order/payment status workflows. That is a major scope expansion into authentication and financial operations, which can cause the agent to perform highly sensitive actions users did not intend or expect.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill states both that it consumes points and that it does not consume points. Conflicting billing semantics can mislead users and supervising systems, causing unexpected charges, repeated calls under false assumptions, or incorrect handling of quota-related failures.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The billing/feedback guidance conflicts with earlier usage instructions, indicating unreliable operational semantics. In a skill that can touch account, merchant, and potentially payment-related flows, inconsistent instructions increase the risk of unauthorized or poorly understood actions being taken without informed user consent.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The document adds account onboarding, SMS login, API-key acquisition, and billing purchase workflows that are outside the stated Shopee merchant-query purpose. In a skill expected to proxy merchant information APIs, unrelated auth and payment handling expands the trust boundary and can be abused to collect credentials, phone numbers, or drive users into unintended account and purchase flows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The instructions explicitly describe collecting a user's phone number, sending SMS codes, logging in, listing plans, creating payment orders, and querying order status. Those capabilities are unjustified for a merchant info lookup skill and create a phishing-like support path where the agent could solicit sensitive data and facilitate purchases unrelated to the declared API function.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: `emit_result()` serializes and saves full API responses from Shopee merchant endpoints to local disk under predictable session directories. Because this skill handles merchant, shop, warehouse, and prepaid-account data, the archival behavior can persist sensitive business data beyond the immediate request and expose it to other local processes, later users, backups, or log collection systems.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The helper creates session directories, metadata, and an index of stored artifacts unrelated to the core function of querying merchant information. This expands the data footprint and makes sensitive results easier to enumerate and correlate across sessions, increasing the chance of unintended disclosure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API key issuance, package listing, ordering, and payment workflows, which are unrelated to the declared Shopee merchant-information skill. Such capability drift is dangerous because it expands the attack surface into credential collection and monetization flows that users and reviewers would not expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create purchase orders and generate payment QR codes, a sensitive financial capability with no justification in a Shopee merchant-query skill. In this context, the mismatch is especially dangerous because it could trick operators into initiating billing actions under the guise of informational API access.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file performs SMS-based login, token handling, team selection, and API key generation for LinkFox accounts, none of which are part of the stated Shopee merchant info purpose. In context this is highly suspicious because it enables credential capture and privilege acquisition under an unrelated skill label.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger is intentionally broad and can activate even when the user does not explicitly mention merchants, as long as the request loosely relates to authorized Shopee cross-border data. Over-broad activation increases the chance of the wrong skill running, which can lead to unnecessary data access, extra API calls, or disclosure of merchant/shop information beyond the user’s actual request.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill says full API responses are always written into the current project directory, but it does not adequately warn that these responses may contain sensitive merchant, warehouse, account, or prepaid-account data. Persisting such data by default can expose it to other tools, repository sync, backups, coworkers, or accidental commits, turning a transient query into durable local leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown tells the operator to ask for the user's phone number and use it for script-driven registration and login, but provides no privacy warning, consent language, retention limits, or sensitivity handling guidance. This increases the risk of unnecessary collection of personal data and conditions users to share phone numbers and verification codes in a context unrelated to the skill's stated Shopee merchant-query function.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The developer proxy helper can forward arbitrary query strings and request bodies to the remote proxy so long as the path starts with `api/v2`. In a skill that proxies merchant API access, this broad forwarding capability increases the risk of overbroad data access or unintended operations if higher-level scripts pass unvalidated inputs or unsupported endpoints.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code writes full API responses to disk without warning or redaction, creating local persistence of potentially sensitive merchant data. In the context of Shopee merchant/account queries, stored responses may include identifiers, warehouse details, or financial account information that should not be retained by default.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The code writes payment QR images to disk automatically, creating persistent artifacts that may expose payment links or transaction details to other local users, logs, backups, or later processes. Because this skill is not supposed to handle payments at all, the disk write is more concerning than it would be in a dedicated billing tool.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: The script creates persistent session directories under workspace, home, or temp paths without clear disclosure or lifecycle controls. This can leave behind QR codes, order data, or other sensitive artifacts accessible to other processes or users on shared systems.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Mandating that every full API response be saved locally regardless of user need violates data minimization and can retain merchant/account information far beyond the requested task. Because the data is session-scoped and stored in the working directory, the surrounding context makes this more dangerous: project directories are often shared, indexed, backed up, or version-controlled.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Beyond saving full responses, the helper prints serialized results or summarized samples to stdout, which can leak sensitive merchant data into terminal logs, agent transcripts, or observability pipelines. Because the skill handles merchant/shop/warehouse/account information, this natural-language output path materially increases disclosure risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 84% confidence
• Finding: This code transmits sensitive authentication material and user data over the network via requests.post. External transmission is expected for an API client, but here it becomes a security issue because the destination is environment-configurable and the skill's stated purpose does not justify these login/token flows.

Static analysis

No suspicious patterns detected.