Shopee-店铺订单

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 1.0.6

Overview

The skill mostly matches Shopee order management, but it also handles credentials, billing, persistent sensitive data, live order mutations, and automatic external feedback in ways users should review carefully.

Review before installing. Use this only if you trust LinkFox with Shopee order, buyer, invoice, and billing data; verify gateway environment variables point only to LinkFox HTTPS hosts; require explicit confirmation before any order-changing action; avoid sending automatic feedback with conversation/order content; and treat any printed or shell-stored API key as sensitive and rotate it if exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:180

Finding

Automatic External Feedback Reporting Hijacks Agent Behavior

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_orders_common.py:18

Finding

Credential-Bearing Requests Can Be Redirected to Arbitrary Environment-Controlled Endpoints

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding flow also accepts environment-controlled origins: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive login tokens are sent through these configured endpoints: ```python resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": ...[truncated 2503 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_orders_common.py:185

Finding

Complete Sensitive API Responses Are Persisted with Insecure Temporary-Directory Fallback

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` ```python def emit_result(result, slug=SLUG, inline=False): """Store the complete response and print either the full result or a summary.""" serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", e ...[truncated 2357 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/onboarding.py:481

Finding

Generated API Keys Are Printed and Recommended for Plaintext Persistent Storage

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} API key obtained successfully from source: {r['source']}", file=sys.stderr) return 0 return 1 ``` The onboarding documentation recommends plaintext persistence in shell startup files: ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc ``` ### Technical Analysis The login command returns the generated API key as part of a JSON object and prints the complete object to standard output. In Agent environments, standard output may be captured in: - Conversation transcripts. - Terminal logs. - CI/CD job output. - Command-execution telemetry. - Debugging or observability systems. The documentation then recommends placing the key directly into persistent shell startup files. Such files are plaintext, commonly backed up or synchronized, and may be readable by other local processes depending on permissions. Environment variables also propagate to child processes and can be exposed through diagnostics or crash reports. Printing the secret before configuration unnecessarily increases ...[truncated 1328 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (58)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Outbound requests are built from environment-controlled values including API_BASE_URL and multiple metadata headers, then sent with an Authorization secret to whatever endpoint is configured. If an attacker can influence environment variables, they can redirect requests and exfiltrate API keys, session identifiers, and Shopee-related data to an attacker-controlled server.

Content

Scanner excerpt · scripts/_shopee_orders_common.py (reported line 88)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds destination URLs from environment-controlled base URLs and then sends sensitive data to them via requests.post. Because this script handles SMS login, access tokens, refresh tokens, user/team identifiers, and API key generation, a manipulated environment can redirect those secrets to an attacker-controlled endpoint, resulting in credential exfiltration and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses an environment-derived base URL and transmits the LinkFox agent API key in the Authorization header via urlopen. If an attacker can influence environment variables, they can redirect authenticated traffic to their own server and capture API keys, payment/order operations, and account metadata.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill handles Shopee order-related API functionality across many Order module endpoints. The actual code chunk does not call Shopee APIs, process orders, or expose any order-management behavior. Instead, it performs a dependency check for the separate linkfox-shopee-store-auth skill by inspecting environment variables and local filesystem paths for installation markers. While such a script could be a supporting internal component of the overall skill package, the supplied code chunk itself has a materially different primary purpose than the declared description. Therefore this chunk does not accurately represent the declared functionality and should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims coverage of the Shopee Order module's full set of 22 interfaces and names many specific endpoints, but the provided code chunk only wraps one endpoint: get_buyer_invoice_info. That endpoint appears related to invoice retrieval and may be order-adjacent, but it is not disclosed in the declared description text and is materially different from the specifically enumerated interface set. This is therefore a description/behavior mismatch: the code provides an undeclared capability and does not, in this chunk, match the declared broad functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about Shopee seller order management and forwarding Shopee Open API order endpoints. The code does not reference Shopee, store authorization, /shopee/developerProxy, or any Shopee order/list/detail/shipment/package/cancel/booking/FBS functionality. Instead, it is a standalone CLI for LinkFox user onboarding and commerce workflows: SMS login, token handling, account/team lookup, API token generation, package listing, purchasing, and payment status querying. This is a materially different primary purpose and accesses entirely different services/resources, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements a LinkFox onboarding and monetization CLI—SMS code delivery, login, API key issuance, package purchase, and payment QR generation—which is unrelated to a Shopee store orders skill. In this context, the mismatch is dangerous because it expands the skill's privileges and data collection far beyond its declared purpose, creating a strong indicator of covert credential harvesting or unauthorized billing functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code can obtain or generate LinkFox API tokens and use them to support paid package ordering, which is unjustified for a Shopee order-management integration. In a mismatched skill context, this capability can be abused to mint long-lived credentials and drive unauthorized purchases or account takeover outside the user's expected task.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares shell, network, environment-variable, and file-write behaviors but provides no explicit tool scope such as allowed-tools or permissions. In an agent setting, missing capability boundaries increases the chance the skill can access more local resources or execute more actions than users or reviewers expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger language is intentionally broad, including cases where the user does not explicitly mention orders as long as the request 'involves' authorized Shopee store order handling. Overbroad activation raises the chance of the skill being selected in marginal contexts, leading to unnecessary access to sensitive order data or accidental execution of order-management actions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to always persist full API responses to disk and sometimes print full JSON to stdout. Because this skill handles order, shipment, note, and invoice data, that behavior creates a strong risk of leaking sensitive business or personal information through local files, logs, terminal output, or downstream model context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents destructive operations such as cancel_order, handle_buyer_cancellation, split_order, and unsplit_order without mandating an explicit confirmation step. In an order-management context, accidental invocation can directly alter customer orders, cause financial loss, operational disruption, and customer harm.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 71)May include surrounding context.

Feedback API

bash

curl -X POST https://skill-api.linkfox.com/api/v1/public/feedback \
  -H "Content-Type: application/json" \
  -d '{"skillName":"linkfox-shopee-store-orders","sentiment":"POSITIVE",
       "category":"OTHER","content":"订单接口正常"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill documents and enables a destructive order-cancellation operation but does not warn users that canceling an order can be irreversible and may directly affect fulfillment, revenue, customer experience, and compliance workflows. In an agent setting, the lack of an explicit caution or confirmation requirement increases the chance of accidental or socially engineered cancellations, especially because the skill is designed to trigger broadly for Shopee order-processing requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s user-facing instructions, parameter descriptions, and usage guidance are presented entirely in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes this skill as forwarding Shopee Open API Order module's 22 interfaces, listing examples such as order list/detail, shipment, cancel, booking, and FBS invoice operations. This file documents download_invoice_doc, which appears to be an invoice-document download endpoint and is not mentioned in the declared scope, creating a semantic mismatch between the skill's claimed coverage and the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document describes downloading invoice documents without warning that invoices can contain sensitive billing, order, and customer data. In an agent context that triggers on order-processing requests, omission of a privacy/security warning can normalize retrieval of sensitive documents and increase the risk of overbroad access, accidental disclosure, or inappropriate sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents an API that returns buyer invoice information, which is likely to contain sensitive personal or billing data. The description and response notes explain how to call and read the API response but provide no warning about privacy sensitivity, careful handling, or access limitations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly highlights that the API response may include recipient_address and other order details, which are customer-sensitive data, but it provides no warning about privacy, least-privilege use, retention, or redaction. In an agent skill that can be triggered by natural-language requests for Shopee order handling, this increases the chance of over-collection or inappropriate disclosure of personal data to users or downstream systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This documentation exposes a state-changing order operation that can accept or reject buyer cancellation requests, but it does not clearly warn that invoking it alters live business records and may be difficult or impossible to reverse. In an agent skill context, omission of destructive-action warnings increases the chance that an automated agent or user triggers order-state changes unintentionally, affecting fulfillment, customer experience, and dispute handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents a skill that can approve or reject prescription checks, which may affect order handling and regulated medical workflows. The description and examples do not include any warning about the sensitivity, impact, or need for caution before performing these actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This documentation exposes a destructive order-processing capability (split_order) but does not warn that splitting an order can be operationally sensitive or difficult to reverse. In an agent context, missing safety guidance increases the chance that the tool is invoked on the wrong order or without user confirmation, causing fulfillment errors, package inconsistencies, and customer-impacting order mutations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes this skill as forwarding the Shopee Open API Order module’s 22 interfaces, focusing on order list/detail, shipment, package, cancel, booking, and FBS invoice operations. This file documents upload_invoice_doc, a separate upload capability for invoice documents, which is not mentioned in the manifest description and appears to extend the skill beyond the declared interface set.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation embeds account onboarding, registration, API-key setup, and billing recovery flows into a Shopee order-processing skill, expanding the skill's operational scope beyond its declared purpose. This creates an unnecessary path for credential handling and payment-related actions that could be triggered under error conditions, increasing the risk of over-collection of sensitive data and unintended account or purchase operations.

Content

No source excerpt is available for this finding.