Shopee-店铺商品管理

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.6

Overview

The skill mostly matches Shopee product management, but it also handles credentials, billing, automatic feedback reporting, and persistent local data in ways users should review carefully.

Review this skill before installing if you use real Shopee stores. It can make live listing changes, delete items, change prices or stock, reply to comments, collect LinkFox login material, create LinkFox billing orders, store full API responses locally, and send feedback externally. Use it only with trusted environment variables, least-privilege credentials, and explicit review before write, delete, billing, or feedback actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:185

Finding

Automatic External Feedback Reporting Hijacks Agent Behavior

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_product_common.py:18

Finding

Credential Exfiltration Through Unrestricted API Endpoint Overrides

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding destination overrides: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Generic credential-bearing request construction: ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: """通用 requests POST，返回 JSO ...[truncated 5831 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_product_common.py:184

Finding

Unsafe Persistence of Full API Responses and Path Traversal Through SESSION_ID

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` The environment-provided session ID is returned without validation: ```python def _lf_session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` The untrusted session value is used as a path component, and the complete response is written without explicitly restrictive permissions: ```pyth ...[truncated 4135 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (120)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code sends sensitive environment-derived values, including the API key and session/message metadata, to a network endpoint whose base URL is also taken from environment variables. If an attacker can influence LINKFOX_TOOL_GATEWAY/SHOPEE_API_BASE_URL or the runtime environment, they can redirect requests and exfiltrate credentials and session identifiers to an attacker-controlled server.

Content

Scanner excerpt · scripts/_shopee_product_common.py (reported line 88)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The POST destination is derived from environment-controlled base URLs, and this code sends sensitive data including phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication and credential flows to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway URL is built from environment-controlled base configuration and used with an Authorization header carrying the agent API key. An attacker who can set or poison the environment can redirect these authenticated requests to a hostile server and capture the API key and related account/order metadata.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is more severe because the documented Shopee product skill appears to include account/login, API-key lifecycle, subscription, order creation, and payment/QR-code operations that are unrelated to product listing management. Hidden auth, billing, or payment capabilities substantially increase risk because they can collect credentials, create charges, or alter account state under the guise of a benign inventory tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is more severe because the documented Shopee product skill appears to include account/login, API-key lifecycle, subscription, order creation, and payment/QR-code operations that are unrelated to product listing management. Hidden auth, billing, or payment capabilities substantially increase risk because they can collect credentials, create charges, or alter account state under the guise of a benign inventory tool.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

共享：`_shopee_product_common.py`、`_product_endpoints.py`、`_product_api_runner.py`。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file embeds authentication recovery, phone-based registration, and billing/purchase workflows that are unrelated to a Shopee product-management skill’s declared purpose. This expands the skill’s effective scope into account onboarding and payment enablement, creating unnecessary access to sensitive account and payment flows and increasing the chance of abuse or social-engineering of users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented ability to collect a phone number, send verification codes, log in, and assist with purchasing plans is not justified by the skill’s stated product-listing function. A product-management skill should not be able to broker identity onboarding or billing transactions, because that creates a privilege and trust boundary mismatch that can be exploited to harvest personal data or induce unintended purchases.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements LinkFox account onboarding, SMS login, API-key issuance, package listing, order creation, and payment QR generation, none of which align with the declared Shopee store product-management purpose. That scope mismatch is dangerous because it introduces hidden credential and billing functionality under an unrelated skill label, increasing the chance of deceptive data collection and unauthorized account monetization actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Embedding order creation, package lookup, and payment QR rendering in a Shopee product-management skill adds unauthorized billing capability unrelated to the advertised function. In context, this is especially risky because users invoking product actions would not reasonably expect subscription purchase behavior, enabling deceptive charging or social-engineered payment requests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code provisions LinkFox credentials through SMS login and then returns a generated API key in output, which is outside the stated Shopee product-management scope. This creates a covert credential-harvesting and account-bootstrap path inside an unrelated skill, making compromise and misuse of user accounts much more likely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes capabilities implying access to environment variables, file writes, network, and shell execution, but does not declare any explicit tool scope or permissions boundary. In an agent environment, this weakens least-privilege controls and makes it easier for the skill to perform sensitive actions beyond what a user would reasonably expect from a Shopee product-management helper.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are overly broad and allow activation for general Shopee product-related discussion, even when the user did not clearly request action on an authorized store. In an agent system, overbroad routing can cause unnecessary access to store-connected tools or sensitive data in contexts that only needed informational conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises destructive or state-changing operations like add, update, unlist, delete, stock, and price changes without clearly warning that they affect live store data. In a commerce context this is more dangerous because accidental invocation can directly impact listings, sales availability, pricing, and customer experience.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs unconditional local persistence of full API responses and also enables automatic feedback reporting, neither of which is clearly necessary for ordinary Shopee product operations. Because product and store API responses may contain commercially sensitive identifiers, inventory, pricing, moderation, or account data, default retention and secondary disclosure materially increase data-exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill requires saving every complete API response to session-linked local files by default, which can capture sensitive store, inventory, pricing, comment, moderation, or account-related data beyond what is needed for the immediate task. Persistent local storage increases the attack surface by creating retrievable artifacts that may be exposed to other tools, users, sessions, backups, or later prompts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatic feedback reporting is outside the core purpose of product management and creates an unnecessary outbound data path. Even if intended for quality improvement, it can leak user intent, store metadata, operational results, or error details to another API without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation instructs use of an Authorization API key plus accessToken and shopId with an external gateway, but provides no handling guidance, minimization advice, or warning about transmitting store credentials and access data to third-party infrastructure. In an agent setting, this can normalize unsafe secret handling and increase risk of credential leakage, misuse, or overbroad data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file applies to SQP-2 and describes write/delete actions such as add_item, update_item, delete_item, and unlist_item. The description lists these capabilities as normal usage but does not warn that they can modify listings, remove products, or affect store availability, which could impact user data and business operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The curl example shows external transmission of sensitive material to tool-gateway.linkfox.com, including Authorization, accessToken, and shopId. Although expected for API usage, in a skill context this is security-relevant because it demonstrates sending secrets and store identifiers to an external proxy endpoint without accompanying safeguards or trust-boundary explanation.

Content

Scanner excerpt · references/api.md (reported line 149)May include surrounding context.

---

curl 示例

bash

export KEY=$LINKFOXAGENT_API_KEY

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation describes a product-creation endpoint (add_item) and provides invocation examples, but it does not clearly warn that this operation can create or modify live marketplace listings. In an agent-skill context, missing mutation warnings increases the chance of unintended writes, accidental listing creation, or unsafe automation against a real seller account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation exposes a state-changing API that creates remote store items but does not clearly warn that invoking it will modify a live Shopee shop. In an agent context, missing mutation warnings increases the chance of unintended inventory or listing changes from ambiguous user prompts, especially because the broader skill is designed to trigger even when users do not explicitly mention product operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation exposes a state-changing marketplace action (boost_item) but does not clearly warn that invoking it modifies listing promotion/visibility for up to five items. In an agent setting, missing side-effect warnings increases the chance of unintended boosts, especially because the skill is designed to trigger on broad product-management intents and can act on authorized stores.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file documents a permanently destructive delete_item capability even though the skill metadata emphasizes product management around listing, querying, and updates. That scope expansion is security-relevant because users or downstream agents may invoke destructive actions they would not reasonably expect from the declared skill behavior, increasing the risk of unauthorized or accidental mass deletion of storefront inventory.

Content

No source excerpt is available for this finding.