Shopee-店铺推送

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.5

Overview

The skill mostly matches Shopee Push management, but it also includes credential onboarding, API-token generation, billing/payment flows, and persistent response storage that deserve user review before installation.

Install only if you are comfortable letting this skill use a LinkFox API key, call LinkFox/Shopee gateway services, save API responses locally, and guide account or billing recovery through phone/SMS and payment-order workflows. Review where linkfox output directories are created and avoid exposing generated API keys in logs or shared transcripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents access to environment variables, shell execution, network calls, and persistent file writes, but no explicit permission declaration is present. This reduces transparency and can cause the skill to operate with broader capabilities than users or the platform expect, especially because it handles API credentials and webhook-related data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is limited to Shopee Push configuration and lost-message management, but the analyzed behavior indicates additional account-management and payment-related capabilities such as login, API key generation, plan purchase, payment QR creation, and order status checks. This mismatch is dangerous because it can expose users to credential handling and financial operations they did not knowingly invoke, a risk amplified by the broad trigger conditions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The shared module writes full API responses to local files under a session directory, even though the skill is described as a Shopee Push forwarding/proxy mechanism. API responses may contain shop identifiers, merchant identifiers, webhook configuration data, lost push message contents, or other sensitive operational metadata, creating unnecessary data-at-rest exposure beyond the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements a full LinkFox onboarding, login, token issuance, subscription, and payment CLI, which is materially unrelated to the declared Shopee Push proxy purpose. Such scope divergence is dangerous because it introduces hidden credential handling and commercial workflows that users and reviewers would not expect from a Shopee webhook configuration skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing and payment order creation, QR-code rendering, and payment-status querying are outside the stated functionality of a Shopee Push configuration skill. Hidden payment capabilities expand the attack surface and can be abused for unauthorized purchases, deceptive user flows, or monetization actions not justified by the skill context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code performs SMS-based login, access-token handling, user-info retrieval, and API-token generation despite the skill claiming to manage Shopee Push proxy endpoints. In this context, hidden authentication and token minting behavior is especially dangerous because it can collect or generate sensitive credentials unrelated to the user’s expected task.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger criteria are intentionally broad, including activation even when the user does not explicitly mention Push, as long as the conversation loosely relates to Shopee Open Platform push configuration or replay management. Over-broad activation increases the chance of unintended execution of networked actions against external APIs, particularly in a skill that can write files and depends on auth context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that full API responses are always written to persistent storage under the working directory, with no clear warning that these responses may contain sensitive operational data such as webhook URLs, account identifiers, message payloads, or other API-returned content. Persistent storage in project directories raises the risk of accidental disclosure through source control, workspace sharing, or later tool access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs collecting a user's phone number and using it in registration/login flows, but it provides no privacy notice, consent language, retention limits, or guidance on secure handling of that personal data. In an agent context, this creates unnecessary exposure of sensitive user data and can lead to improper collection, logging, or transmission of phone numbers and verification codes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function forwards user-controlled parameters such as query_string, body, shop_id, and merchant_id directly to developer_proxy_call, which results in outbound network requests to the Shopee proxy without any confirmation, disclosure, or policy gating in this file. In a skill designed to manage Push/webhook configuration, this is security-relevant because an agent could change callback settings or acknowledge lost messages using attacker-influenced input, causing unintended external actions or data exposure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The file-writing logic persists complete API responses to disk without any user warning, consent, or obvious data minimization. In a skill handling Shopee push configuration and message recovery, this can silently retain sensitive business data and tokens-adjacent metadata, increasing exposure if the host is multi-user, backed up, or later compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI emits the generated API key directly to stdout, where it may be captured by logs, shell history, agent transcripts, or downstream tooling. In an agent environment this is particularly risky because outputs are often persisted or exposed to components beyond the immediate user.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.