Shopee-店铺退货

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:48 PM UTC
• Version: 1.0.5

Overview

This skill mostly does what it says for Shopee returns, but it handles sensitive store, payment, and account data with weak scoping and persistence safeguards.

Install only if you are comfortable giving this skill access to a LinkFox API key and authorized Shopee store return data. Before using write actions such as confirm, dispute, cancel_dispute, accept_offer, or proof uploads, require a human confirmation with the exact shop and return_sn. Treat saved linkfox session files and payment QR files as sensitive, and avoid using environment-variable URL overrides outside a controlled development setup.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used with requests.post. In a skill/runtime environment where env vars can be influenced by a host, deployer, or attacker with config access, this can redirect phone numbers, SMS codes, access tokens, and generated API keys to an attacker-controlled endpoint, creating a credential exfiltration/SSRF-style risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL used by urllib.request.urlopen is built from environment-controlled base configuration and carries the Authorization header from LINKFOX_AGENT_API_KEY. If the base URL is redirected through environment manipulation, the skill will transmit API credentials and billing/order traffic to an attacker-controlled server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities to access environment variables, write files, invoke shell scripts, and make network requests, yet no explicit permission model is declared. In an agent setting, this creates hidden authority: users and reviewers cannot easily understand that the skill can read secrets, persist sensitive API responses, and execute external calls, which increases the risk of data leakage or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is Shopee returns/refunds handling, but the behavior reportedly includes LinkFox login, SMS verification, API key generation, plan/package listing, payment order creation, order-status checks, and QR-code rendering. This is a severe scope expansion into authentication and billing flows, which can expose credentials, trigger financial actions, or socially engineer users under the guise of a returns tool.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill states both that it consumes points and that it does not consume points, creating contradictory operational guidance. This can mislead users or agents into making repeated calls or approving actions under false assumptions about cost, and it also undermines trust in other safety-critical documentation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The explicit '不消耗积分' statement conflicts with earlier text warning that the tool consumes points and should avoid repeated probing. Contradictory billing documentation can be exploited to induce unintended usage, create billing disputes, or hide abusive behavior behind ambiguous operator guidance.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The shared helper persistently writes full API responses to local disk under predictable directories, which exceeds the stated purpose of proxying Shopee returns/refunds API calls. Those responses may contain customer PII, addresses, reverse-logistics details, dispute evidence metadata, or tokens/errors, creating unnecessary at-rest exposure and post-session data residue.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file implements account onboarding, SMS login, API key issuance, package listing, purchase, and payment QR flows, which are unrelated to the declared Shopee returns/refunds skill. This mismatch is dangerous because a user invoking a commerce-returns skill could instead be funneled into credential collection and billing actions outside the advertised purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The substantive code path is dedicated to LinkFox account management and monetization rather than Shopee returns/refunds API handling claimed in the metadata. Such deceptive scope mismatch is a strong indicator of hidden or misleading behavior and raises the risk of unauthorized credential capture, token generation, and payment initiation under false pretenses.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation condition is intentionally broad, allowing the skill to trigger even when the user does not explicitly mention returns, as long as the conversation involves an authorized Shopee store. Over-broad triggering increases the chance of invoking a powerful networked skill in the wrong context, causing unintended data access, writes, or external actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown instructs the skill to persist complete API responses to local files by default, but it does not present a clear user-facing warning about retention, sensitivity, or where the data will remain. Since return/refund responses may contain buyer, order, shop, dispute, and logistics information, silent persistence materially increases privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation instructs use of a credentialed gateway (`Authorization: <api_key>`, access tokens, shop IDs) and also includes a feedback API call to another external service, but it provides no warning that user/store data and secrets may be transmitted off-platform. In an agent skill context, this can lead operators or downstream agents to send sensitive business data, tokens, or identifiers to third-party endpoints without informed consent or data-minimization controls.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation exposes an operation that accepts a buyer or seller return/refund offer and explicitly encourages passing the full body through to the upstream API, but it provides no warning that the action may finalize or materially alter a dispute outcome. In an agent setting, missing guardrails around a state-changing returns action increases the risk of accidental approval, unauthorized financial loss, or irreversible workflow changes if the tool is invoked from ambiguous user instructions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation exposes a dispute-cancellation action and even shows direct invocation examples, but it does not warn that cancelling a dispute may be irreversible or materially affect a merchant's rights in an ongoing return/refund case. In an agentic context, lack of cautionary guidance increases the chance that a user or downstream automation will trigger a destructive business action without explicit confirmation or understanding of consequences.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation exposes a business-impacting action that confirms a return, but it does not warn that the operation may be irreversible or should only be performed with explicit user approval. In an agent setting, vague or overly broad triggering around return/refund handling increases the chance the tool could be invoked on the wrong order or without adequate confirmation, causing unauthorized return acceptance and financial/operational loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation exposes a state-changing dispute operation as a simple POST/pass-through action without any warning, confirmation, or guidance about the business impact of opening a return dispute. In an agent setting, this increases the chance that the tool is invoked automatically or on ambiguous user intent, causing unintended disputes, seller-buyer conflict escalation, or irreversible workflow changes in the Shopee store.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation describes an action that uploads return shipping proof to a remote Shopee API, but it does not clearly warn the user that invoking the skill will transmit data externally and may trigger an operational returns workflow. In an agent setting, that omission can cause users or upstream systems to authorize a state-changing action without informed consent, increasing the risk of unintended data disclosure or business-process changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The onboarding instructions ask the user to provide a phone number for script-driven registration, but they do not disclose how that personal data is handled, stored, transmitted, or retained. In a skill context where all embedded instructions must be treated as potentially adversarial, collecting a phone number without privacy notice or minimization increases the risk of unnecessary exposure of personal data and social-engineering abuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code saves API responses to disk automatically and only prints a status message after the write, without prior user notice or consent. In a skill handling returns/refunds, this can silently retain sensitive commercial and customer data beyond the user's expectations, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The CLI outputs freshly generated API keys to stdout and stores payment QR images on local disk without strong in-file warnings or safeguards. In agent/workspace environments, stdout may be logged and session directories may be accessible to other processes or users, leading to unintended exposure of credentials and payment artifacts.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The instruction to always write complete API responses into session-linked local files creates persistent storage of potentially sensitive commerce and dispute data beyond the immediate task. Because the files are tied to session identifiers and written under the working directory, this expands the attack surface for later unauthorized access, accidental inclusion in repositories, or cross-task data exposure.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The response-logging helper stores complete API results in plaintext JSON and announces the saved path, which may expose sensitive shop, customer, logistics, refund, or dispute data to other local users, backup systems, or later processes. Because this skill operates on returns/refunds workflows, the contents are likely to include materially sensitive business and personal information.

Static analysis

No suspicious patterns detected.