Shopee-店铺SBS

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.5

Overview

Review recommended: the skill can perform the advertised Shopee SBS inventory lookups, but it also handles account login, API-key creation, payment ordering, and default local saving of full store responses.

Install only if you are comfortable with LinkFox handling Shopee store data, phone/SMS login, API-key provisioning, and billing-related flows. Treat generated API keys and saved response files as sensitive, avoid using environment overrides for service URLs unless you control them, and delete local linkfox session data when it is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The code sends authentication material and user data to a URL derived from environment-controlled base URLs via requests.post. If an attacker can influence LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, they can redirect SMS login, access tokens, refresh tokens, and API-token generation traffic to an attacker-controlled host, causing credential exfiltration. The mismatch between this onboarding/account flow and the SBS warehouse-query skill makes this more suspicious and increases risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request uses urlopen on a Request whose URL is built from environment-controlled agent base configuration, while attaching the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY can redirect all gateway calls, including account, package, and order operations, to an arbitrary server and capture the API key and related metadata. In a skill that is supposed to query Shopee SBS data, this credential-bearing commerce/onboarding traffic is especially out of scope and dangerous.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill declares powerful capabilities in practice (environment access, file writes, network access, and shell execution) without an explicit permission model or user-visible disclosure. This weakens governance and informed consent, and increases the blast radius if the skill is misused or extended, especially because it handles authorized store data and local persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is limited to five Shopee SBS query APIs, but the skill reportedly also performs LinkFox account login, API key lifecycle operations, account info retrieval, subscription listing, payment order creation, order-status checks, and QR code generation. That is a major scope expansion into authentication and billing flows, creating risk of credential misuse, unintended account actions, and financial operations outside user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper persistently writes full Shopee SBS API responses to local disk under a session directory. SBS inventory, warehouse, stock movement, and expiry data can be commercially sensitive, and storing full responses without minimization, retention controls, or explicit disclosure increases the blast radius of host compromise, cross-session leakage, or accidental exposure.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, plan listing, order creation, and payment QR rendering, which are unrelated to the advertised Shopee SBS warehouse-query function. Such hidden commercial/payment capabilities expand the attack surface and can be abused to trigger purchases, collect user phone numbers, or steer users into credential and payment flows they did not request.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code logs a user in by SMS and then retrieves or generates a live API token, returning it to stdout. This is far beyond SBS warehouse lookup and effectively turns the skill into a credential acquisition utility; if invoked in an agent environment, it could mint reusable access credentials for later abuse. Because the skill metadata does not disclose token-generation behavior, the context makes this especially dangerous.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file's primary behavior is an onboarding/account-commerce CLI, not Shopee SBS API forwarding as declared in the skill metadata. This discrepancy indicates deceptive packaging and raises the likelihood that users or the host system could be induced to run unrelated login, token, or payment operations under the guise of inventory queries.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger scope is intentionally broad enough to activate even when the user does not explicitly mention SBS, as long as the request resembles authorized Shopee warehouse or inventory queries. Over-broad activation can cause unnecessary access to sensitive shop data, unintended API calls, and surprise data retrieval in contexts where the user did not clearly request this specific integration.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill says full API responses may be written to local files by default, but it does not clearly require user-facing notice or consent for data persistence. Since SBS responses can contain sensitive authorized shop inventory and warehouse information, silent persistence increases privacy and data-retention risk beyond the immediate interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The curl example demonstrates sending both an API key and an access token in a request body/header but provides no warning that these are sensitive secrets that must not be hardcoded, logged, shared, or committed. In an agent-skill context, examples are often copied verbatim into real integrations, so omission of credential-handling guidance increases the risk of accidental secret disclosure and unauthorized access to Shopee store inventory data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The Feedback API example shows posting arbitrary content to an external public endpoint without warning that user/shop data may leave the local environment. In a skill that handles operational inventory information, users may include sensitive business details in feedback, creating an avoidable outbound data exposure risk if they follow the example without understanding where the data is sent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding instructions explicitly direct the operator to collect a user's phone number and pass it to a script for registration, but they provide no consent flow, retention limits, masking guidance, or privacy notice. This creates unnecessary privacy and data-handling risk, especially because phone numbers are personal data and the instructions normalize transmitting them through a local script path without safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes complete API responses to disk and does so without any visible consent, warning, or operator-facing disclosure. Even if the storage is intended for debugging or workflow continuity, undisclosed persistence of third-party business data creates privacy, compliance, and insider-access risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The login command emits a live API key directly in stdout JSON, which is commonly captured by logs, agent transcripts, shell history, or calling applications. Exposing a reusable credential this way can lead to account compromise and unauthorized API usage, especially in automated multi-tenant environments.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The order flow writes payment QR code images to local disk in predictable session directories without warning, increasing the chance that payment artifacts persist and are later accessed by other local users, processes, or support tooling. While lower severity than token leakage, it still creates unnecessary retention of sensitive commercial artifacts.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to always save complete API responses into a session-scoped local directory, creating durable copies of authorized shop data that may outlive the user’s immediate request. Persistent storage of full responses increases the risk of later exposure through other tools, users, processes, backups, or accidental disclosure from the working directory.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The result emission path both saves full responses to disk and may print them inline when small or when --inline is used. That creates two leakage channels for potentially sensitive SBS data and any accidentally returned secrets, making exposure more likely through logs, transcripts, terminal capture, shared workspaces, or downstream tooling.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.