Shopee-店铺公共模块

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.6

Overview

The skill mostly matches a Shopee API proxy, but it has under-disclosed account, API-key, billing, and sensitive-data storage behavior that users should review before installing.

Review this skill carefully before installing. It can forward Shopee OAuth data through LinkFox services, help create or retrieve a LinkFox API key through SMS login, and initiate LinkFox billing orders. Use it only in a trusted environment, avoid endpoint override variables unless you fully control them, do not paste production tokens into examples, and clean or protect the generated linkfox output files because they may contain secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_public_common.py:18

Finding

Credential Exfiltration Through Unrestricted Service Endpoint Overrides

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding service origins are similarly configurable: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Sensitive access tokens are subsequently attached to requests sent to those origins: ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { ...[truncated 3651 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_public_api_runner.py:60

Finding

Plaintext Persistence and Output of Shopee OAuth Secrets

Content

View full analysis

str: if "body" in params: body = params["body"] if isinstance(body, str): return body return json.dumps(body, ensure_ascii=False, separators=(",", ":")) if "requestBody" in params: rb = params["requestBody"] if isinstance(rb, str): return rb return json.dumps(rb, ensure_ascii=False, separators=(",", ":")) ``` ```python out: dict = { "api": api_name, "developerProxy": proxy, "resolvedPath": path, } if query_string: out["queryString"] = query_string if body is not None: out["requestBody"] = json.loads(body) if body else None merge_shopee_body(out, proxy, response_key) return out ``` The complete result is then written to disk: ```python def emit_result(result, slug=SLUG, inline=False): """Persist the complete response under linkfox/date/session/data.""" serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) print(f"Saved full response: {out} ({len(serialized)} bytes)") ``` ### Technical Analysis The Skill support ...[truncated 2663 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_public_common.py:217

Finding

Path Traversal Through Unsanitized SESSION_ID

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` The value is inserted directly into a filesystem path: ```python sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding implementation repeats the same unsafe construction: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name, but no restrictions are placed on its content. Python's `os.path.join` does not enforce containment: - A value containing `..` can traverse out of the intended session directory. - An absolute value can cause earlier path components to be discarded. - Platform-specific separators can redirect output into nested or external directories. The affected sinks create directories and write JSON metadata, re ...[truncated 2012 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/check_auth_dependency.py:114

Finding

Unpinned External Skill Installation Guidance Creates Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (42)

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The request sent via urlopen includes multiple environment-derived headers such as SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME, and the Authorization API key, and the destination base URL can also be overridden by environment variables. This creates a real data exfiltration risk because sensitive session metadata and credentials may be transmitted to an attacker-controlled endpoint if the runtime environment is manipulated or misconfigured.

Content

Scanner excerpt · scripts/_shopee_public_common.py (reported line 88)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends authentication material, including access tokens and generated API keys, to those endpoints via requests.post. If an attacker can influence the process environment or deployment configuration, the skill can be redirected to attacker-controlled infrastructure, causing credential exfiltration and unauthorized account actions.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway helper composes outbound URLs from environment-derived base paths and uses urlopen with an Authorization header sourced from LINKFOX_AGENT_API_KEY. An attacker who controls those environment variables can redirect privileged requests and API keys to a malicious endpoint, enabling credential theft and abuse of billing/order operations.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill provides access to Shopee Public API endpoints via /shopee/developerProxy. However, the provided code does nothing related to Shopee API communication, OAuth exchange, token refresh, merchant/shop retrieval, or IP whitelist retrieval. Its sole behavior is to inspect environment variables and filesystem locations to determine whether another skill (linkfox-shopee-store-auth) is installed, then report success or failure. That is a materially different primary purpose from the declared API proxy behavior, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is specifically about forwarding Shopee Open API Public-module endpoints. The supplied code contains no Shopee logic, no /shopee/developerProxy usage, and none of the six declared public API operations. Instead, it implements a standalone LinkFox onboarding/payment tool that interacts with LinkFox domains (api.linkfox.com, agent-api.linkfox.com, tool-gateway.linkfox.com), handles SMS-based authentication, team/account metadata, API token generation, package listing, order creation, and payment QR rendering. This is a materially different primary purpose and introduces multiple undeclared capabilities unrelated to Shopee Public APIs.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 38)May include surrounding context.

md

| 脚本 | `scripts/refresh_access_token.py` |
| Method / path | POST `api/v2/public/refresh_access_token` |
| 官方文档 | [refresh_access_token](https://open.shopee.com/documents/v2/v2.public.refresh_access_token?module=104&type=1) |
| 用途 | Refresh access token; pass full body |

经 **`POST /shopee/developerProxy`** 转发。Public 多为 Partner / OAuth 级接口，**通常无需** `shopId`/`merchantId`；日常授权优先走 `linkfox-shopee-store-auth`。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/apis/get-access-token.md (reported line 8)May include surrounding context.

md

| 脚本 | `scripts/refresh_access_token.py` |
| Method / path | POST `api/v2/public/refresh_access_token` |
| 官方文档 | [refresh_access_token](https://open.shopee.com/documents/v2/v2.public.refresh_access_token?module=104&type=1) |
| 用途 | Refresh access token; pass full body |

经 **`POST /shopee/developerProxy`** 转发。Public 多为 Partner / OAuth 级接口，**通常无需** `shopId`/`merchantId`；日常授权优先走 `linkfox-shopee-store-auth`。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/apis/get-access-token.md (reported line 24)May include surrounding context.

md

| 脚本 | `scripts/refresh_access_token.py` |
| Method / path | POST `api/v2/public/refresh_access_token` |
| 官方文档 | [refresh_access_token](https://open.shopee.com/documents/v2/v2.public.refresh_access_token?module=104&type=1) |
| 用途 | Refresh access token; pass full body |

经 **`POST /shopee/developerProxy`** 转发。Public 多为 Partner / OAuth 级接口，**通常无需** `shopId`/`merchantId`；日常授权优先走 `linkfox-shopee-store-auth`。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/apis/refresh-access-token.md (reported line 8)May include surrounding context.

md

| 脚本 | `scripts/refresh_access_token.py` |
| Method / path | POST `api/v2/public/refresh_access_token` |
| 官方文档 | [refresh_access_token](https://open.shopee.com/documents/v2/v2.public.refresh_access_token?module=104&type=1) |
| 用途 | Refresh access token; pass full body |

经 **`POST /shopee/developerProxy`** 转发。Public 多为 Partner / OAuth 级接口，**通常无需** `shopId`/`merchantId`；日常授权优先走 `linkfox-shopee-store-auth`。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/apis/refresh-access-token.md (reported line 24)May include surrounding context.

md

| 脚本 | `scripts/refresh_access_token.py` |
| Method / path | POST `api/v2/public/refresh_access_token` |
| 官方文档 | [refresh_access_token](https://open.shopee.com/documents/v2/v2.public.refresh_access_token?module=104&type=1) |
| 用途 | Refresh access token; pass full body |

经 **`POST /shopee/developerProxy`** 转发。Public 多为 Partner / OAuth 级接口，**通常无需** `shopId`/`merchantId`；日常授权优先走 `linkfox-shopee-store-auth`。

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_public_endpoints.py (reported line 34)May include surrounding context.

python

"path": "api/v2/public/get_access_token",
        "method": "POST",
        "response_key": "getAccessToken",
        "notes": 'Exchange auth code for access token; pass full body',
    },
    "refresh_access_token": {
        "path": "api/v2/public/refresh_access_token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_public_endpoints.py (reported line 40)May include surrounding context.

python

"path": "api/v2/public/get_access_token",
        "method": "POST",
        "response_key": "getAccessToken",
        "notes": 'Exchange auth code for access token; pass full body',
    },
    "refresh_access_token": {
        "path": "api/v2/public/refresh_access_token",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements LinkFox onboarding, SMS login, API-key retrieval, and payment workflows that do not match the manifest's stated Shopee Public API purpose. That mismatch is dangerous because it hides credential collection and account/bootstrap behavior behind an unrelated skill label, increasing the chance that users or operators invoke it with misplaced trust.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The order-creation and QR-payment flow materially exceeds the declared Shopee public-module proxy role and introduces the ability to initiate commercial transactions. In a mislabeled skill, this can facilitate unauthorized purchases, social-engineering-driven payments, or covert monetization under the guise of an unrelated API integration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill can log users in by SMS and then retrieve or generate LinkFox API tokens, which is a powerful credential-issuance capability unrelated to the stated Shopee Public API function. In context, this creates a covert path for account takeover or persistent access by harvesting user phone verification and converting it into reusable API credentials.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises capabilities that involve environment access, file writes, networking, and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates unnecessary ambiguity and increases the blast radius if the skill is invoked in a broader-capability agent runtime, especially because the skill also handles OAuth-related operations and writes outputs to disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description is written to require/assume Chinese-language trigger phrases and usage guidance, but it does not provide an explicit language choice or explain that the skill is intentionally restricted to a Chinese-speaking context. Per policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that full API responses are always written to disk, and those responses may include OAuth access tokens, refresh tokens, shop identifiers, or other sensitive partner data. Persisting such material by default without warning, redaction, encryption, or retention controls significantly raises the risk of credential theft, accidental commit, or lateral access by other local processes/users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation contains contradictory statements about whether the skill consumes compute quota and how quota/billing failures should be handled. This can mislead users into triggering paid operations under the assumption that they are free, undermining informed consent and safe operational use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The file instructs users to POST data, including authentication material, to an external domain (tool-gateway.linkfox.com) via a proxy. External transmission is expected for an API integration skill, but the lack of explicit trust-boundary disclosure and sensitive-data handling guidance makes this a real security concern because users may not realize credentials are being forwarded through intermediary infrastructure.

Content

Scanner excerpt · references/api.md (reported line 46)May include surrounding context.

---

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/shopee/developerProxy \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation includes a curl example that sends an Authorization API key and an access token to a remote endpoint without any warning about secret handling, redaction, storage, or safe use. In an agent skill context, this can normalize unsafe credential sharing and increase the chance that users or downstream tooling expose reusable secrets to third-party infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly instructs users to exchange an auth code for an access token and to 'pass full body' through a proxy, but it provides no warning that OAuth codes, client-related secrets, and returned tokens are sensitive credentials that must be handled carefully. In an agent skill context, this omission increases the chance that secrets are logged, echoed back in chat, stored in command history, or forwarded through intermediary systems without redaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This documentation exposes a token-exchange capability and instructs users to pass the full request body, but it does not warn that resend codes, access tokens, refresh tokens, and related OAuth artifacts are sensitive secrets that must not be logged, shared, or pasted into insecure channels. In an agent or proxy workflow, missing handling guidance increases the chance of credential disclosure through chat history, shell history, logs, screenshots, or copied examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This documentation instructs users how to call a token refresh endpoint but provides no warning that the request body and response may contain highly sensitive OAuth credentials, including refresh tokens and newly issued access tokens. In an agent or automation context, that omission increases the risk that operators will paste secrets into logs, examples, chat transcripts, or insecure tooling, leading to credential disclosure and downstream account compromise.

Content

No source excerpt is available for this finding.