Shopee-店铺推送

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches its Shopee Push purpose, but it also handles login, API keys, payments, and persistent response storage with weak safeguards.

Review before installing. Use this only if you trust LinkFox to process Shopee Push requests and are comfortable with local storage of full responses. Avoid pasting phone codes or API keys into shared chats or logs, prefer a proper secret store over shell profiles, and do not run it in an environment where gateway-related variables or SESSION_ID may be controlled by someone else.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_push_common.py:18

Finding

Environment-controlled gateway can receive LinkFox and Shopee credentials

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` ```python def developer_proxy_call( path: str, method: str, shop_id: Optional[str] = None, merchant_id: Optional[str] = None, query_string: Optional[str] = None, body: Optional[str] = None, content_type: str = "application/json", access_token: Optional[str] = None, ) -> dict: ... if access_token: proxy["accessToken"] = access_token ... return call_api(DEVELOPER_PROXY_ENDPOINT, proxy) ``` ### Technical Analysis The destination used for authenticated API requests can be replaced through `LINKFOX_TOOL_GATEWAY` or `SHOPEE_API_BASE_URL`. The code does not enforce HTTPS, validate the destination hostname, or restrict overrides to an allowlist. `call_api()` sends the LinkFox API key in the `Authorization` header to whichever endpoint was constructed. `developer_proxy_call()` can also place a Shopee access token in the JSON payload. Although the normal Push runner does not currently supply its op ...[truncated 1380 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_push_common.py:213

Finding

Unsanitized session identifier permits writes outside the intended data directory

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding utility repeats the same unsafe path construction: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted path component. The code does not reject absolute paths, `..` components, directory separators, platform-specific drive prefixes, or symlink-based escapes. If `sid` is absolute, `os.path.join(root, date_str, sid)` discards th ...[truncated 1529 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:478

Finding

Onboarding workflow exposes authentication secrets through process arguments, stdout, and shell profiles

Content

View full analysis

` - `python scripts/onboarding.py login ` - After obtaining `api_key`: - Windows PowerShell: `setx LINKFOX_AGENT_API_KEY ""` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` ``` The generated API key is included in the returned object: ```python return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` It is then printed in full: ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` The CLI defines both sensitive values as positional arguments: ```python p = sub.add_parser("login", help="Log in with a verification code and obtain an API key") p.add_argument("phone") p.add_argument("code", help="SMS verification code") p.add_argument("--channel", default="skill", help="Channel, default skill; WorkBuddy hosts use workbuddy") ``` ### Technical Analysis Command-line arguments can be recorded in shell history and may be observable through process-inspection facil ...[truncated 1785 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_push_common.py:178

Finding

Complete Push API responses are persisted with ambient permissions and may fall back to a temporary directory

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root ``` ```python def emit_result(result, slug=SLUG, inline=False): """Persist the full response under linkfox///data/-.json.""" serialized = json.dumps(result, ensure_ascii=False, indent=2) ... os.makedirs(session_dir, exist_ok=True) ... os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) print(f"Saved full response: {out} ({len(serialized)} bytes)") ``` This conflicts with the declared storage policy in `SKILL.md`: ```text Always write the complete response under /linkfox/... Writing to /tmp is prohibited; report an error if the current directory is not writable. ``` ### Techni ...[truncated 1737 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Onboarding recommends unpinned third-party package installation

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The runtime tells users to install mutable package names without exact versions, hashes, a lockfile, or a documented trusted package index. Package resolution therefore depends on the user's current pip configuration and whatever versions are available when the command is run. The package names are legitimate and there is no evidence that this Skill intentionally selects a malicious package. The weakness is the absence of reproducible and integrity-verified dependency management. ### Attack Path 1. `qrcode`, `pillow`, or `requests` is unavailable in the runtime. 2. The Skill emits an instruction to run an unpinned `pip install` command. 3. The user executes that command in an environment configured to use a compromised, substituted, or otherwise untrusted package index. 4. Pip resolves mutable package artifacts without project-provided hashes. 5. A compromised dependency executes during installation or later import. ### Impact Assessment A malicious dependency would execute with the privileges of the user running pip or the Skill. That could expose environment variables, including the LinkFox API key, access local files, alter the Python environment, or execute arbitrary commands. Exploitation depends on a compromised dependency source or future upstream package compromise; no s ...[truncated 53 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data, including phone numbers, SMS codes, access tokens, refresh tokens, and derived API-token requests, to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or impersonation tokens.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway helper sends authenticated requests using an API key in the Authorization header to a URL derived from environment variables. A hostile runtime or wrapper can redirect these calls to an attacker-controlled server, causing API key disclosure and unauthorized use of account, package, and order operations.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description says this skill provides Shopee Push functionality and forwards four Shopee Open API Push interfaces. However, the only provided code performs a local environment/dependency check: it inspects filesystem paths and environment variables to locate linkfox-shopee-store-auth's SKILL.md, emits JSON/status messages, and exits with a dependency-specific exit code if missing. That is materially different from the declared purpose. While dependency checking could be a supporting utility within a larger skill, this code chunk itself does not implement any of the advertised Shopee Push behavior, so the description does not accurately represent what this supplied code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is specifically about Shopee Push/Open API webhook configuration and lost push message management through a developer proxy. The supplied code does nothing related to Shopee, push callbacks, webhook configuration, developerProxy forwarding, or the four named Shopee endpoints. Instead, it implements a LinkFox onboarding and payment workflow: SMS auth, login, user/team lookup, API token generation, package listing, order creation, QR rendering, and order querying. This is a materially different primary purpose and includes several undeclared capabilities unrelated to the stated Shopee Push functionality.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file implements LinkFox onboarding, login, plan purchasing, and payment QR generation even though the declared skill is supposed to proxy Shopee Push API configuration and lost-message operations. This scope mismatch is dangerous because it can trick users or hosting agents into invoking credential collection and billing functionality unrelated to the advertised purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These routines perform package discovery, order creation, and payment handling, which are unrelated to Shopee Push webhook configuration. In the context of an allegedly Shopee integration skill, embedded purchasing flows materially increase risk of unauthorized charges, deceptive upsell behavior, and abuse of user trust.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code initiates SMS-based login, exchanges verification codes for access tokens, and generates API keys, none of which are necessary for Shopee Push proxying as described in the metadata. Hidden credential acquisition inside an unrelated skill is especially dangerous because it enables account takeover or token harvesting under false pretenses.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares operational capabilities such as environment-variable use, filesystem writes, shell execution, and network access, but does not declare any tool scope or permission boundaries. This weakens reviewability and can enable unintended or excessive actions if the runtime grants broad defaults, especially because the skill can persist data and invoke external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is explicitly broad enough to activate even when the user does not mention Push, increasing the chance of over-invocation. In a skill that can access auth-dependent APIs, write files, and contact external services, broad triggering can cause unnecessary data handling or external calls outside the user's intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states both that use consumes credits and that it does not consume credits, creating inconsistent operator guidance. This can cause the agent or user to proceed under false assumptions, leading to unintended billable actions or repeated queries without proper consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents automatic persistence of full API responses to disk without an explicit sensitivity warning or data-minimization controls. Push configuration and related API responses may contain callback URLs, account identifiers, or operational metadata that should not be stored by default, especially in shared project directories.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require full response persistence and may print complete JSON to stdout or force full inline output, which can leak sensitive account or webhook data into logs, transcripts, CI output, or chat context. Because the skill interacts with authenticated APIs, this exposure risk is amplified by the possibility of disclosing operational secrets or customer data beyond the immediate task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 39)May include surrounding context.

---

curl 示例

bash

curl -X POST https://tool-gateway.linkfox.com/shopee/developerProxy \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

These instructions tell an operator to collect a user's phone number, trigger SMS login, obtain an API key, and relay it back without any privacy, consent, storage, redaction, or secret-handling guidance. That creates a real risk of exposing personal data and account credentials through chat logs, terminal history, screenshots, or operator mishandling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function sends query parameters and/or request bodies to developer_proxy_call, which can transmit user-provided data over the network. While the module docstring states it runs Push module APIs, this code includes no confirmation prompt, user-facing log, or inline warning about the outbound transmission of request content or identifiers such as shopId/merchantId.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_shopee_push_common.py (reported line 37)May include surrounding context.

python

print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr)
        sys.exit(DEPENDENCY_EXIT_CODE)
    try:
        result = subprocess.run(
            [sys.executable, str(checker)],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

developer_proxy_call() and related helpers forward shopId, merchantId, optional accessToken, query strings, and bodies to a remote gateway endpoint. While that forwarding is core to the skill's function, this file provides no minimization, redaction, or visible disclosure, so sensitive identifiers and credentials may be transmitted to infrastructure beyond the immediate Shopee API boundary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The logging/output layer prints summaries of responses and stores full serialized results plus session metadata to disk. In this skill context, responses may include push configuration, identifiers, error details, and lost message contents, so natural-language logs and archived JSON can retain sensitive user or shop data longer than necessary and expose it to anyone with filesystem access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The helper adds broad session-oriented filesystem logging, metadata tracking, indexing, and cross-session file organization that are not required to perform a simple Shopee Push proxy call. This expands the data-handling surface and creates a durable local audit trail of user activity and response artifacts, which becomes more dangerous in a skill handling commerce-related account integrations and push message management.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

emit_result() serializes and writes full API responses to local disk under predictable session folders, even though this skill's stated purpose is only to proxy Shopee Push configuration and lost-message operations. Those responses may contain shop identifiers, webhook configuration details, lost push message payloads, or tokens returned by the gateway, creating unnecessary sensitive-data retention and increasing exposure to local users, support tooling, or later compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The login command emits a live API key in stdout JSON, which may be captured by logs, agent transcripts, shell history tooling, or downstream integrations. In an agent-skill environment, stdout is often persisted or exposed more broadly than intended, making direct credential emission a serious secret leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes a curl example that sends an Authorization header and an accessToken to a remote endpoint, which is a privacy- and security-relevant behavior. The surrounding documentation does not provide any warning or caution about using real credentials, protecting tokens, or the fact that the request transmits sensitive authentication data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file contains core usage instructions primarily in Chinese while some operational descriptions remain in English. Because the file does not indicate that the skill is region-specific or provide an opt-in language choice, it may violate a language/locale policy requiring explicit user choice or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.