Shopee-店铺限时特卖

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 1.0.5

Overview

This Shopee flash-sale skill is mostly coherent, but it handles store authority, account credentials, billing, and local response logs with enough unsafe scoping to require Review before install.

Review this skill carefully before installing. Use it only in a controlled environment, keep LINKFOX_* endpoint variables unset unless you trust the destination, avoid running it where SESSION_ID or workspace paths can be attacker-controlled, and treat saved linkfox response files as sensitive merchant data. Require explicit human confirmation before create, update, delete, or payment-order commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_shop_flash_sale_common.py:18

Finding

Environment-Controlled Endpoints Can Exfiltrate Authentication Credentials

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding implementation similarly accepts unrestricted endpoint overrides: ```python def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` It then sends authentication data to those destinations: ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = _uid_header(a ...[truncated 2521 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_shop_flash_sale_common.py:216

Finding

Unsanitized SESSION_ID Allows Output Path Traversal

Content

View full analysis

str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` The unvalidated value is incorporated into the output path: ```python sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding workflow contains the same pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted directory name. It is not restricted to a safe character set, and the resolved output path is not verified to remain below the intended `linkfox/` directory. On common platforms, values containing `..` path components can escape the intended session directory. An absolute path may also cause `os.path.join()` to discard preceding components. The Skill then creates directories and writes r ...[truncated 1390 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_shopee_shop_flash_sale_common.py:181

Finding

Complete API Responses May Be Persisted in an Unsafe Temporary Directory

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` Every complete result is then written without explicit restrictive permissions: ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with ope ...[truncated 2166 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/onboarding.py:163

Finding

Onboarding Recommends Installation of Unpinned Third-Party Packages

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The onboarding workflow instructs users to install `requests`, `qrcode`, and `pillow` without version constraints, hashes, a lockfile, or a specified trusted package index. The package names shown are established packages rather than apparent typosquats, and the code does not automatically execute `pip`. Therefore, this is not evidence of an intentionally malicious dependency. However, following the instructions resolves whatever package version the active Python package index currently serves, making installations non-reproducible and vulnerable to a compromised index, malicious future release, or unsafe package-source configuration. ### Attack Path 1. A user invokes an onboarding operation without the required package installed. 2. The script instructs the user to run an unpinned `pip install` command. 3. The user’s pip configuration points to a compromised or attacker-controlled index, or a malicious package release is served under the expected name. 4. The user executes the suggested command. 5. Malicious package installation or import-time code runs with the privileges of the user performing the installation. ### Impact Assessment A compromised dependency can execute arbitrary code with the privileges of the Python environment or user account. It could access environment v ...[truncated 324 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (37)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A second, more severe mismatch indicates behavior tied to SMS login, token issuance, account info, plan purchase, payment orders, QR rendering, and payment-status flows instead of Shopee Flash Sale management. This is dangerous because it crosses into account/payment infrastructure, potentially exposing credentials, billing actions, or identity flows under the cover of an unrelated e-commerce management skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A second, more severe mismatch indicates behavior tied to SMS login, token issuance, account info, plan purchase, payment orders, QR rendering, and payment-status flows instead of Shopee Flash Sale management. This is dangerous because it crosses into account/payment infrastructure, potentially exposing credentials, billing actions, or identity flows under the cover of an unrelated e-commerce management skill.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements LinkFox account onboarding, SMS login, API key retrieval, subscription browsing, order creation, and payment QR generation, which are materially unrelated to a Shopee Shop Flash Sale API-forwarding skill. This scope mismatch is dangerous because it introduces credential collection and billing behaviors that users would not reasonably expect from the declared skill, increasing the chance of deceptive data harvesting or unauthorized purchases.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Order creation and QR payment rendering enable direct purchase flows inside a skill whose advertised function is Shopee flash-sale management. In context, this is more dangerous because users invoking a storefront automation skill are unlikely to expect hidden billing capabilities, creating risk of social engineering, surprise charges, or abuse of stored API credentials to initiate purchases.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises capabilities that imply shell, network, environment access, and file writing, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope constraints increases the chance the skill can invoke broader-than-necessary capabilities, making misuse or accidental data access harder to prevent and audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is intentionally broad, allowing activation even when the user does not explicitly mention flash-sale keywords. Overbroad triggering can cause the wrong skill to run for general store-management requests, increasing the chance of unnecessary API calls, unintended side effects, or disclosure of store data in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to always write complete API responses to disk, but does not warn about or limit storage of potentially sensitive business data such as campaign details, item metadata, shop identifiers, or operational history. Persisting full responses by default expands the data exposure surface beyond the immediate task and can leave sensitive records in local project directories.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Mandating that every API response be persisted in a session-organized local log creates systematic over-retention of user and store data. In agent environments, local logs may be accessible to other tools, later tasks, or repository workflows, so storing more data than needed increases confidentiality and compliance risk without clear necessity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes creation, update, and deletion operations for Shop Flash Sale resources, including deleting activities or items, but it does not warn that these actions can alter or remove live shop promotion data. Under the markdown-specific warning criteria, behaviors affecting user data or system integrity should be disclosed clearly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 51)May include surrounding context.

---

curl 示例

bash

curl -X POST ${LINKFOX_TOOL_GATEWAY}/shopee/developerProxy \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly exposes a create operation for Shopee flash sale events and states to 'pass full body', but it does not warn that this action modifies live shop promotional configuration. In an agent skill context, missing mutation warnings and confirmation guidance can lead to unintended creation of real flash sale events, causing operational disruption, pricing/promotion mistakes, or unauthorized campaign changes on a connected store.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This documentation describes a destructive API operation that removes items from a flash sale, but it provides no warning about the irreversible business impact, no confirmation requirements, and no guidance to validate target IDs before execution. In an agent-driven workflow, that omission increases the chance of accidental or unauthorized destructive actions, especially because the skill is designed to trigger on natural-language requests related to Shopee flash sale management.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This documentation exposes a destructive API operation that deletes flash sale data but provides no warning, confirmation flow, rollback note, or guardrails for human or agent-driven use. In an agent skill context, missing deletion safeguards increases the chance of unintended destructive actions against a live Shopee store, especially when the skill is designed to trigger on broad flash-sale management requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s operational instructions and parameter descriptions are primarily presented in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document states this endpoint returns flash sale details by flash_sale_id, but the documented JSON inputs only include shopId or merchantId and omit the required business parameter. This can cause callers to issue malformed requests, retrieve no data, or build unsafe workarounds that guess or inject parameters outside the documented contract, increasing the chance of operational errors in a privileged commerce-management workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes a state-changing operation that updates live flash sale settings but does not warn users that the action can modify production shop configuration. In an agent-driven context, this omission increases the chance of unintended or unauthorized business changes, such as altering active promotions, pricing windows, or campaign behavior for a real merchant account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to collect a user's phone number and use it to drive registration/login flows, but it provides no privacy notice, consent language, retention limits, or safe-handling guidance. In an agent context, this creates a real risk of unnecessary collection and exposure of personal data, especially if the number is transmitted, logged, or stored during support workflows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_shopee_shop_flash_sale_common.py (reported line 41)May include surrounding context.

python

print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr)
        sys.exit(DEPENDENCY_EXIT_CODE)
    try:
        result = subprocess.run(
            [sys.executable, str(checker)],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The helper builds and sends POST requests to external endpoints using parameters that include shopId, merchantId, query strings, request bodies, and optionally access tokens. Although network access is central to the skill, this file does not provide any confirmation prompt or user-facing disclosure before transmitting that data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The session logging and archival layer adds behavior beyond the core API proxy function by creating directories, metadata indexes, and durable local records of activity. This expands the skill's attack surface and data footprint, making sensitive operational data available outside the immediate request flow without clear necessity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The helper writes full API responses to local files under predictable session directories, even though the skill is described as an API forwarding helper for Shopee Flash Sale operations. Those responses may contain sensitive business data, identifiers, tokens, or operational metadata, creating unnecessary local data retention and increasing exposure if the host is shared or later compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Persisting full API responses to disk without clear disclosure creates a confidentiality risk because returned data may include sensitive store details, pricing, inventory, or auth-related metadata. In the context of an e-commerce management skill, retaining such data locally is more dangerous because it concerns real merchant operations and may outlive the original user interaction.

Content

No source excerpt is available for this finding.