Security audit

Shopee-店铺商品管理

Security checks for vulnerabilities and agentic risk

Overview

The skill is largely a real Shopee product-management integration, but it needs Review because it can change live store data and includes account, billing, credential, feedback, and response-retention behavior with weak guardrails.

Install only if you trust LinkFox with your Shopee store operations and are comfortable with live listing changes. Before using it, require explicit confirmation for any create, update, delete, unlist, stock, price, boost, SKU, or comment action; avoid sharing SMS codes or API keys unless you intend to complete LinkFox setup; review any payment step carefully; and periodically delete or protect the local linkfox response logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill exposes meaningful capabilities—environment-variable access, local file writes, network calls, and shell execution—without an explicit permission declaration. In an agent setting, this weakens policy enforcement and user awareness, making it easier for the skill to access secrets, write sensitive data, or invoke external systems without clear review boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: A product-management skill should not also handle LinkFox account login, API-key generation, plan purchase, payment QR creation, or order-status checks unless that behavior is prominently disclosed and separately authorized. This mismatch can mislead users and reviewers, and it expands the attack surface into account access and billing flows that are more sensitive than ordinary product CRUD operations.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The helper unconditionally serializes and writes full API responses to local disk under a predictable workspace directory. Shopee product API responses can include sensitive business data, tokens, identifiers, inventory, pricing, and other operational details; persisting all of it exceeds the stated forwarding purpose and creates a local data exposure and retention risk.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file implements LinkFox account onboarding, SMS login, subscription discovery, and payment workflows, which are materially unrelated to the advertised Shopee store product-management capability. Such scope mismatch is dangerous because users invoking a Shopee product skill could be induced into exposing phone numbers, SMS codes, or operational credentials for an unrelated platform.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The ability to create orders and render payment QR codes is not justified by a Shopee product-management skill and expands the trust boundary into billing. In context, this creates a social-engineering and unauthorized-purchase risk because a user expecting listing or inventory actions may instead be prompted into paying for unrelated services.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This section performs SMS-based LinkFox authentication and API-token generation, which is outside the declared Shopee product-management scope. Even if the behavior is operationally legitimate for the vendor, embedding it in this skill can mislead users into surrendering authentication factors and creates an unnecessary credential-handling surface.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger conditions are intentionally broad enough to fire on generic Shopee-related conversation, including cases where the user did not explicitly request product operations. In a skill that can query and modify live store listings, overbroad activation increases the chance of unintended data access or accidental state-changing actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises destructive and state-changing capabilities—such as add_item, update_item, update_price, update_stock, unlist_item, and delete operations—without a strong warning that these affect live store inventory and listings. In commerce workflows, accidental execution can cause direct business harm including lost sales, pricing mistakes, and listing disruption.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation provides a direct example for invoking a product-creation endpoint (`add_item`) against a live Shopee store, but it does not warn that this action can create or modify marketplace data. In an agent-skill context, that omission increases the risk of accidental listing creation, unintended catalog changes, or misuse by users who do not realize the operation is state-changing.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: This documentation exposes a state-changing POST operation that can modify listing visibility/placement ('boost') without any explicit warning, confirmation, or usage guardrails for the caller. In an agent skill context, that increases the risk of accidental or unauthorized commercial actions being triggered from ambiguous user requests, especially because boosting affects live shop operations even if it does not directly change price or inventory.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This documentation exposes a permanently destructive product-deletion operation but does not prominently warn that the action is irreversible or require any confirmation safeguards. In an agent-driven workflow, vague user requests or automation mistakes could cause unintended deletion of live listings, leading to operational loss and difficult recovery.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This documentation exposes a destructive SKU deletion capability but provides no warning, confirmation requirement, rollback guidance, or mention of irreversible effects. In an agent skill that can be triggered from natural-language requests against authorized Shopee stores, omission of safety guidance increases the chance of accidental or unauthorized destructive actions being carried through automation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This documentation exposes a destructive product operation ('unlink item from SSP') without clearly warning the user that it modifies listing linkage state and may affect catalog synchronization or storefront behavior. In an agent-triggered commerce skill, missing safety guidance increases the chance of unintended execution from ambiguous user requests, leading to accidental inventory/listing changes in an authorized shop.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This documentation exposes a live product-unlisting operation but does not warn that invoking it changes storefront availability and can immediately take listings offline. In an agent skill context, missing safety language increases the chance that an automated workflow or user invokes the endpoint without understanding the business impact, causing accidental delisting, sales disruption, or inventory visibility issues.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This documentation describes a remote state-changing product update operation ('update_item') but does not warn that it can modify live marketplace listings, prices, stock, or other product data in an authorized Shopee store. In an agent-skill context, missing mutation warnings increases the chance of unintended or overly broad updates being executed against production merchant assets, especially when triggered from natural-language requests.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document describes a state-changing product update operation and provides direct execution examples, but it does not warn that the call can modify live remote catalog data in an authorized Shopee store. In an agent-skill context, this increases the chance of accidental or insufficiently confirmed destructive actions such as unintended item-kit changes, especially when triggered from broad product-management intents.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This documentation describes a live price-modification endpoint but does not clearly warn that invoking it changes production listing prices in an authorized Shopee store. In an agent context, incomplete safety guidance can cause accidental bulk or unintended price changes, especially because the examples imply direct operational use against real shop credentials.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This documentation describes a live inventory modification endpoint but does not clearly warn that it changes production stock levels. In an agent-driven environment, missing change-impact warnings can lead to unintended stock updates, overselling, underselling, or operational disruption if a user or upstream tool invokes it without realizing it is state-changing.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The onboarding instructions explicitly tell the agent/operator to collect a user's phone number and use it to trigger registration and login flows, but they provide no privacy notice, consent guidance, data minimization, or handling restrictions for the phone number and returned authentication material. In a skill context, this creates a real risk of unnecessary collection of personal data and unsafe handling of one-time codes or API keys during support interactions.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The instructions direct persistent modification of shell startup files and storage of an API key in environment variables without warning that this writes secrets to user configuration files and may expose them to other local users, shells, logs, or support transcripts. While common operationally, doing so without disclosure or safer alternatives increases the chance of credential leakage and unintended persistence.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This script directly exposes a destructive product-variant deletion operation by passing user-supplied JSON to the delete_model API without any built-in confirmation, dry-run, or guardrails. In the context of a Shopee store product-management skill, accidental or automated invocation could delete live SKU/model data and disrupt listings, inventory management, or sales operations.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The login flow returns the full API key in stdout JSON, which can be captured by logs, transcripts, shells, orchestration layers, or downstream tools. Because this is a reusable bearer credential, any exposure can enable account misuse and unauthorized API access beyond the immediate session.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instruction to always persist full API responses to local session-organized files creates unnecessary retention of potentially sensitive store, product, account, or customer-related data beyond the immediate task. Persisting complete responses by default broadens exposure to later misuse, accidental inclusion in context, local compromise, or access by other tools/processes in the workspace.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The instruction to auto-report feedback based on user reactions or anything that 'could be improved' risks transmitting user content, task context, or metadata to another API without explicit, informed consent. Because the rule is broad and non-specific, it can capture sensitive business details or conversational content unrelated to the user's request.

Static analysis

No suspicious patterns detected.