Security audit

Shopee-店铺分类

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does Shopee shop-category work, but it also handles account onboarding, API keys, payments, destructive store changes, and persistent response logging in ways users should review carefully.

Review this skill before installing. Use it only if you are comfortable with LinkFox handling Shopee store-management calls, account onboarding, API-key issuance, and payment-order creation. Avoid using the bundled SMS login or billing flow unless you intentionally want that, confirm any delete/remove operations before running them, and clean up the local linkfox response files if they contain merchant or product data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and relies on environment-variable access, shell execution, network calls, and persistent file writes, but does not declare permissions or boundaries for those capabilities. This weakens reviewability and consent, making it easier for the agent to invoke sensitive operations without clear visibility into what data is accessed or where it is sent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is limited to Shopee shop-category management, but the skill ecosystem behavior includes account login, API-key generation, billing/package lookup, payment order creation, QR rendering, and order-status querying. That is a major scope expansion into authentication and payments, which can surprise users and cause unauthorized account or financial actions if triggered through the same skill flow.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation says the tool consumes credits and warns against repeated queries due to cost, but later states '不消耗积分' (does not consume credits). Contradictory billing semantics can mislead users into unintended paid actions or cause the agent to make decisions under false cost assumptions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: `emit_result()` serializes and writes the full API response to disk under a persistent session directory. For a Shopee store-management skill, responses may include shop metadata, category structures, item associations, tokens returned by proxy flows, or other sensitive operational data, and persisting them locally expands the exposure surface beyond the user's expected API action.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file implements LinkFox onboarding, SMS login, API key issuance, subscription discovery, ordering, and payment QR generation, which are unrelated to Shopee shop-category management. This scope mismatch is dangerous because it introduces credential handling and monetization capabilities into a skill that should only manage Shopee categories, expanding the attack surface and enabling unauthorized account or billing actions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Billing and payment-order creation are unjustified for a Shopee category-management skill and enable purchase flows, QR payment generation, and order-state queries from within an unrelated tool. In context, this makes the skill more dangerous because users invoking store-category operations would not reasonably expect payment capabilities to be present.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code performs SMS-based LinkFox login, fetches team/user info, and obtains or generates API tokens, all outside the declared Shopee Shop Category scope. This is dangerous because it collects authentication factors and creates reusable credentials in a context where users expect category management, increasing the chance of credential misuse or over-privileged automation.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger logic is overly broad, including a fallback rule that activates the skill whenever an authorized Shopee shop's category management is merely implicated, even without explicit mention of categories. Overbroad activation increases the chance the agent selects this skill in the wrong context and performs unintended networked or state-changing actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to persist complete API responses to local files by default, potentially storing shop data, item associations, identifiers, and account-related metadata beyond what is needed for the immediate response. Because the write is automatic and the warning is operational rather than privacy-focused, users may not understand the retention and exposure implications.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This documentation exposes a destructive API operation that removes items from a shop category but provides no warning, confirmation guidance, or safety constraints. In an agent-driven context, that omission increases the chance of accidental or overly broad deletions by users or automated workflows, especially because the skill is designed to trigger on Shop Category management requests.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This documentation exposes a destructive category-deletion capability but provides no warning, confirmation requirement, or guardrails around irreversible or high-impact use. In an agent skill context, that omission increases the chance an automated workflow or user will trigger deletion unintentionally, especially since the skill is designed to act on authorized shops through a proxy endpoint.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs operators to collect and process a user's phone number for registration and login via SMS without any privacy notice, consent language, retention limits, or guidance on secure handling. This creates privacy and compliance risk because personal data is being solicited and transmitted through an operational workflow with no stated safeguards.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code writes full API responses to local disk and only prints a save-path message, without any explicit user-facing warning that their store data will be retained. This creates a transparency and privacy problem because users invoking a proxy/forwarder skill would reasonably expect transient processing, not local persistence.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The login flow returns the generated API key directly in stdout JSON, which can be captured by logs, transcripts, agent memory, downstream tooling, or other observers. In a skill environment, this is particularly risky because stdout is often persisted and surfaced beyond the immediate caller.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Always writing full API responses into session-linked local paths creates unnecessary data retention and cross-task correlation risk, especially when responses may include store structure, product-category mappings, and other merchant data. Tying files to a session identifier can also make later discovery or aggregation of sensitive data easier if the workspace is shared or reused.

Static analysis

No suspicious patterns detected.