Shopee-店铺公共模块

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:47 PM UTC
• Version: 1.0.5

Overview

This Shopee API skill is mostly coherent, but it handles tokens, phone-login onboarding, billing orders, and always-on local response storage with weaker scoping and disclosure than the access warrants.

Review before installing. Use only in a workspace where storing Shopee/LinkFox API responses on disk is acceptable, avoid pasting real tokens into chat or logs, prefer self-service account setup at the LinkFox site, and do not set custom LinkFox gateway/login URL environment variables unless you fully trust the destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The POST destination is derived from environment-controlled base URLs, and this function sends sensitive login and token-management data to whatever host those variables specify. In a skill/runtime environment where env vars can be influenced by deployment or another component, this enables credential exfiltration or redirection to attacker infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and includes the API key in the Authorization header. If an attacker can alter the environment, outbound requests can be redirected to a malicious server and the API key exposed, with follow-on abuse of the linked account or services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents use of environment variables, shell execution, network access, and file writes, but does not declare any permissions or capability boundaries. This weakens reviewability and consent, and can lead operators to invoke a skill without realizing it can access secrets, write local files, and make external requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is limited to Shopee Public API proxying, but the referenced behavior includes account login, API-key generation, plan purchase, payment order creation, QR rendering, and order-status queries. Hidden or undisclosed monetization and account-management flows significantly expand the attack surface and could enable credential abuse, unauthorized billing actions, or social-engineering-style payment collection under the guise of a Shopee integration.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill is declared as a Shopee Public API module, but the documentation directs operators to run a separate onboarding script for registration, login, and billing flows unrelated to that purpose. This expands the skill's effective scope into account onboarding and payment handling, increasing the chance of unsafe operator actions, credential mishandling, and abuse through an unexpected execution path.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file tells operators to handle auth and billing gateway errors by invoking an external onboarding workflow, which contradicts the manifest's stated Shopee Public API function. This kind of hidden scope expansion is dangerous because it creates a covert fallback path for collecting user data, obtaining API keys, and initiating purchases under the guise of normal API troubleshooting.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: `emit_result()` serializes and writes full API responses to local disk under predictable session directories, along with metadata indexing. Because this skill handles token exchange and Shopee public/auth-adjacent responses, the stored data can include sensitive tokens, shop identifiers, request/response contents, or user data that persist beyond the immediate task and are accessible to other local processes or later sessions.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements LinkFox onboarding, SMS login, package purchase, and order handling rather than the declared Shopee Public API functionality. A skill whose code materially differs from its stated purpose is dangerous because it can trick users or the platform into granting access and handling credentials for an unrelated workflow.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Purchasing and payment QR generation are unrelated to a Shopee Public API wrapper and expand the blast radius to financial actions. In the context of a supposedly public-API skill, hidden commerce capabilities increase the risk of deceptive or unauthorized charges and misuse of trust.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code performs SMS-based LinkFox login, token exchange, team selection, and API key retrieval/generation, none of which match the stated Shopee public-module purpose. This creates a covert credential-acquisition path inside a mismatched skill, making user deception and secret handling substantially more dangerous.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes curl examples that send an Authorization header and accessToken to external Linkfox endpoints for Shopee token-related operations, but it provides no warning about secret handling, redaction, storage, or transmission risks. In an agent skill context, this omission can cause users or downstream agents to paste real credentials into requests without understanding they are being forwarded to third-party infrastructure.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explains how to exchange an auth code for an access token and emphasizes passing the full body, but it does not warn that auth codes, access tokens, and related payloads are sensitive secrets that must not be exposed in logs, examples, chats, or shared outputs. In an agent skill context, this omission can lead users or downstream tooling to handle OAuth material insecurely, increasing the risk of credential leakage and account compromise.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document instructs callers to refresh OAuth access tokens and to 'pass full body' through a proxy, but it does not warn that the request will contain sensitive authentication material such as refresh tokens and possibly partner credentials. In practice, this omission increases the chance that users or downstream tooling will log, echo, or mishandle secrets during invocation and troubleshooting.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions explicitly tell operators to ask for a user's phone number and use it to run registration/login commands, but provide no privacy notice, consent language, retention limits, or verification steps. That creates a real risk of unnecessary collection of personal data and account takeover or impersonation if the flow is abused or misunderstood.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The helper persists complete API responses to disk without any disclosure, consent, or visible warning to the user. In the context of OAuth token exchange and proxying external API traffic, silent logging materially increases the risk of credential exposure, privacy violations, and unintended long-term retention of sensitive business data.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code generates or retrieves an API token and returns it directly without any in-file warning, confirmation, or guidance about the sensitivity of that secret. In a skill ecosystem, silently surfacing long-lived credentials raises the risk of accidental disclosure through logs, transcripts, or downstream tool chaining.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The payment QR code PNG is written to a local session directory without an explicit warning that a payment artifact is being persisted on disk. While not a direct exploit by itself, local persistence can expose payment links or transaction details to other local users, backup systems, or later processes.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The response handling path both writes full serialized results to disk and may print them inline to stdout when small or when `--inline` is used. Since proxied API responses may contain access tokens, resend codes, shop/merchant identifiers, or other sensitive payloads, this creates multiple plaintext disclosure channels in logs, terminal history, and local files.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This code transmits authentication and account data to external services via HTTP requests. External transmission is expected for API clients, but here it becomes risky because the destination is configurable and the payload includes sensitive login/token material.

Credential Access

High

• Category: Privilege Escalation

Content

- Method：**POST**
- POST：传 `body` / `requestBody`，或把 `body_fields` 列在 JSON 顶层
- `shopId` / `merchantId` / `skipDepCheck` 等为网关选店保留字段，不会进 Shopee query/body
- Registry notes：Exchange auth code for access token; pass full body

---

• Confidence: 84% confidence
• Finding: The instruction to 'pass full body' for access-token exchange encourages forwarding complete OAuth payloads without any warning or minimization guidance. In practice, full request bodies for token exchange can contain authorization codes, client-linked data, or returned secrets, and broad forwarding through a proxying agent increases the chance of sensitive credential material being logged, retained, or exposed to unintended components.

Static analysis

No suspicious patterns detected.