Security audit

Shopee-店铺收款

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Shopee payment operations, but it handles sensitive financial, account, credential, and billing flows with weak scoping and retention safeguards.

Review before installing. Use it only if you are comfortable sending Shopee payment data through LinkFox, treat phone codes and API keys as secrets, explicitly confirm any set_* installment changes, and delete saved linkfox response files when they are no longer needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises and instructs use of environment variables, shell execution, network calls, and local file writes, but does not declare permissions or present clear least-privilege boundaries. This creates a trust gap where an agent may execute sensitive capabilities without explicit approval, increasing the chance of unintended data exposure or overbroad execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A payment-settlement skill that also performs unrelated LinkFox login, token acquisition, package browsing, order creation, QR rendering, and payment-status queries materially exceeds its declared purpose. This broadens the attack surface and could be used to collect credentials, mint API access, or drive unintended purchases and account actions under the guise of Shopee settlement support.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The document first states the tool consumes credits and warns against repeated attempts, then later claims 'no credits consumed.' Contradictory billing semantics can mislead users and agents into performing extra paid operations or suppressing cost-related safeguards, especially in an API skill handling repeated queries and report generation.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file embeds a full account onboarding and billing workflow inside a Shopee payment-settlement skill, including Linkfox account registration, API key acquisition, and plan purchase steps that are outside the stated purpose of querying Shopee settlement/payment data. This expands the skill's operational scope into credential handling and commercial transactions, increasing the chance that an agent will solicit sensitive data or drive users into unrelated account/payment flows.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The helper persistently writes full Shopee payment API responses to local disk, including potentially sensitive payout, wallet, escrow, and income data. In a payment-settlement skill, this materially increases exposure through local file disclosure, over-retention, and unintended secondary access by other processes or users on the host.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file implements LinkFox account onboarding, SMS login, API-key issuance, package purchase, and payment-order handling, which is materially unrelated to the advertised Shopee store payment/settlement capability. This scope mismatch is dangerous because it prompts users to perform sensitive account and payment actions under a misleading skill identity, increasing the chance of credential exposure and unauthorized billing flows.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code can log users into LinkFox, derive team context, and obtain or generate platform API tokens, which is a powerful account bootstrap capability unrelated to Shopee settlement queries. In a skill advertised for Shopee payment operations, this expands privilege and trust requirements far beyond user expectation and could be abused to mint reusable credentials for later access.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger conditions are broad enough to activate on generic discussions of payment, settlement, payout, income, or authorized store finances even when the user did not intend to invoke this specific skill. Over-triggering on financial topics increases the risk of unnecessary API calls, unintended disclosure of sensitive store financial data, and surprise execution of actions in the wrong context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill mandates writing complete API responses containing payment, payout, wallet, and income data to local files by default, without an explicit privacy notice, retention policy, or minimization controls. Persisting full financial payloads in the working directory can expose sensitive business data to other tools, users, repositories, backups, or accidental commits.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The documentation lists state-changing installment-setting APIs without clearly warning that they modify store or item payment configuration. In an agent skill context, this increases the risk that an automated workflow or user invokes these endpoints as if they were informational, causing unintended business-impacting changes to payment behavior.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This document describes a state-changing payment API that modifies installment status but provides no warning, confirmation guidance, or caution about financial side effects. In a payment/settlement skill, omission of such safeguards can lead users or downstream agents to invoke the operation unintentionally, causing incorrect financing settings or business-impacting payment changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation exposes an operation that enables or disables a live shop installment/payment setting but does not warn that it changes production financial configuration. In an agent-driven context, missing safety guidance increases the chance of unintended state-changing actions, especially when users ask broad payment or settlement questions that could trigger this skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The instructions tell operators to request phone numbers, handle verification codes, execute login flows, and distribute generated API keys, but they do not include safeguards for minimizing collection, masking secrets, avoiding transcript leakage, or warning users not to share credentials insecurely. In an agent setting, this can directly lead to exposure of SMS codes and long-lived API keys through chat logs, terminal history, or misdirected responses.

Missing User Warnings

High

Confidence: 91% confidence
Finding: The developer proxy helper forwards caller-supplied path, query string, body, and optional access token to a remote service with only a minimal path-prefix check. In a payment context, this creates a broad proxy surface that can be abused to reach unintended API actions, over-collect financial data, or exfiltrate sensitive request contents through the gateway.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The result emitter writes complete API responses to disk without any clear warning or opt-in, which is especially risky for payment settlement data that may contain transaction histories and financial details. Silent persistence increases the chance of accidental disclosure and long-lived sensitive data remnants.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The script enumerates many environment-derived skill and workspace directories, then includes the resolved search roots and any discovered dependency path in its output/stderr. This can disclose local filesystem layout, usernames, workspace locations, or other deployment details to logs or upstream callers, which is unnecessary for normal dependency checking and can aid reconnaissance in multi-tenant or shared-log environments.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The CLI emits a freshly obtained API key directly to stdout JSON, which may be captured by logs, transcripts, orchestration layers, shell history wrappers, or downstream tools. Because this is a reusable credential, accidental disclosure can lead to unauthorized API access and account misuse.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The output layer stores full responses plus session-linked metadata such as session IDs, timestamps, file indexes, and skill usage in predictable local directories. Combined with the payment nature of the skill, this creates a significant data retention and correlation risk that could expose merchant financial activity and session history to local attackers or other software.

Static analysis

No suspicious patterns detected.