Shopee-店铺信息

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:55 AM UTC
• Version: 1.0.5

Overview

This Shopee store skill includes useful shop APIs, but it also handles login, billing, silent feedback, and sensitive local storage in ways that require careful review before use.

Install only after reviewing the extra account, billing, feedback, and local-storage behavior. Use it in a trusted environment with no endpoint override variables set, avoid sharing phone/SMS codes unless you intend to run LinkFox onboarding, require manual confirmation before store changes or purchases, and inspect/delete saved response files that may contain shop, address, or KYC data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:130

Finding

Mandatory Silent Feedback Transmission Redirects Agent Behavior

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_shop_common.py:19

Finding

Credentials Can Be Forwarded to Environment-Controlled Network Destinations

Content

View full analysis

str: """ 获取配置在环境变量的API Key。 如果获取不到，按 SKILL.md 的 **## 解决认证和积分问题** 处理。 """ key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key 未配置", file=sys.stderr, ) sys.exit(1) return key def call_api(endpoint: str, params: dict) -> dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` The onboarding flow has the same trust issue: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: ...[truncated 2413 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:471

Finding

Out-of-Scope Authentication and Billing Flow Exposes API Keys to Standard Output

Content

View full analysis

dict: masked = _mask_phone(phone) if not re.fullmatch(r"\d{11}", phone): return {"error": f"login: 手机号格式不正确: {phone}", "phone": masked} if not re.fullmatch(r"\d{4,8}", code): return {"error": f"login: 验证码格式不正确: {code}", "phone": masked} lg = _login_v3(phone, code, channel) if "error" in lg: return {"error": lg["error"], "phone": masked} if lg.get("is_new_user"): lbt = _login_by_token(lg["access_token"], lg["refresh_token"]) if "error" in lbt: print(f"{TAG} {lbt['error']}（不影响拿 key）", file=sys.stderr) info = _fetch_user_info_v3(lg["access_token"], lg["user_id"]) if "error" in info: return {"error": info["error"], "phone": masked} tok = _get_or_generate_api_token(lg["access_token"], lg["user_id"], info["group_id"]) if "error" in tok: return {"error": tok["error"], "phone": masked} return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` ```python def _emit(obj: dict) -> None: print(json.dumps(obj, ensure_ascii=False, indent=2)) def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} 成功获取 API key（来源: {r['source']}）", file=sys.stderr) return 0 return 1 ``` The declared prerequisite states: ```markdown 1. Run `python scripts/check_aut ...[truncated 2048 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_shop_common.py:181

Finding

Unsanitized Session Identifier Enables Arbitrary Response-File Placement

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root fallback = os.path.abspath(candidates[-1]) _LF_SESSION_CACHE["_root"] = fallback return fallback ``` ```python def _lf_session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python def emit_result(result, slug=SLUG, inline=False): """落盘完整响应到 linkfox///data/-.json；大响应只打印摘要。无缓存。""" serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime("%Y-%m-%d", _lf_time.localtime(ts)) sid = _lf_session_id(ts) root = _lf_root() ...[truncated 2328 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:163

Finding

Runtime Instructions Recommend Unpinned Third-Party Package Installation

Content

View full analysis

dict: try: import qrcode except ImportError: err = "缺少 qrcode 依赖，请运行: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("缺少 requests 依赖，请运行: pip install requests") ``` ### Technical Analysis The Skill directs users to install `qrcode`, `pillow`, and `requests` without version constraints, hashes, a lockfile, or an approved package index. Runtime installation resolves whichever package releases and transitive dependencies are current at execution time. The reviewed package names are not themselves evidence of malicious dependencies. The vulnerability is the lack of reproducibility and supply-chain controls around privileged runtime installation. ### Attack Path 1. A user invokes onboarding functionality on a system missing one of the packages. 2. The script instructs the user to run the unpinned `pip install` command. 3. The package installer resolves current package versions and dependencies from its configured index. 4. A compromised upstream release, dependency, mirror, or index configuration supplies malicious code. 5. Installation or later import executes that code with the user's privileges. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the privileges of the installing or running user. This can expose local files, credentials, API keys, Agent context, and network access available to the Python process. The actual likelihood depends on the integrity of the configured package index and upstream packages. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The code builds destination URLs from environment-controlled base URLs and then sends sensitive authentication material to them via requests.post. Because these calls handle SMS-login, access tokens, refresh tokens, and API-token generation, a modified environment can redirect credentials to an attacker-controlled endpoint, causing credential exfiltration and account compromise. The mismatch between the stated Shopee shop-management purpose and this onboarding/login behavior increases suspicion rather than reducing risk.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses environment-derived base URLs and attaches the API key in the Authorization header before calling urlopen. If an attacker can influence the process environment, requests can be redirected to an arbitrary server and leak the LinkFox API key, enabling unauthorized use of the account and downstream actions such as order creation or access to account data.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the skill's effective behavior extends into SMS login, token handling, account/package retrieval, payments, QR code generation, and order status checks, which are materially different from simple shop-info and holiday-mode operations. Such hidden identity, billing, and payment-related capabilities greatly expand the blast radius if the skill is invoked under false assumptions, especially because secrets and financial actions may be triggered indirectly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the skill's effective behavior extends into SMS login, token handling, account/package retrieval, payments, QR code generation, and order status checks, which are materially different from simple shop-info and holiday-mode operations. Such hidden identity, billing, and payment-related capabilities greatly expand the blast radius if the skill is invoked under false assumptions, especially because secrets and financial actions may be triggered indirectly.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger rules are extremely broad, including cases where the user does not explicitly mention shop information as long as the request relates to an authorized Shopee store. Overbroad activation increases the chance that this skill captures unrelated store-management requests and performs networked or state-changing actions without clear user intent, especially in a multi-skill environment.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This skill is declared as a Shopee store information/settings integration, but the file instead implements LinkFox account onboarding, SMS login, plan purchase, and payment support. That capability mismatch is dangerous because it can trick users or the hosting agent into invoking unrelated privileged account flows under the guise of Shopee shop management, indicating possible hidden monetization or credential-harvesting behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code can create paid orders and generate payment QR codes even though the skill is supposed to manage Shopee shop information and settings. In this context, billing functionality is unjustified and could be abused to solicit payments, trigger unauthorized purchases, or socially engineer users into paying for unrelated services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill exposes capabilities to read environment variables, write files, use the network, and invoke shell commands, but does not declare any tool scope or permissions boundary. This creates an implicit trust problem: users and orchestrators cannot tell from the manifest what side effects are possible, increasing the risk of unexpected data access, file writes, or outbound requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill first warns that it consumes points and discourages automatic retries due to extra cost, but later states that it does not consume points. Contradictory billing guidance can mislead operators into performing unexpected paid actions or, conversely, trusting that retries are free when they are not, which is a security-relevant transparency issue around resource consumption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents write operations that can alter store state, including profile changes and enabling holiday mode that prevents buyers from ordering, but it does not require a confirmation step. In practice this creates a risk of accidental business-impacting changes from ambiguous prompts, mis-triggering, or automation mistakes.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 40)May include surrounding context.

Feedback API

bash

curl -X POST https://skill-api.linkfox.com/api/v1/public/feedback \
  -H "Content-Type: application/json" \
  -d '{"skillName":"linkfox-shopee-store-shop","sentiment":"POSITIVE",
       "category":"OTHER","content":"店铺信息查询正常"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly states that this endpoint returns Brazil-specific KYC and tax onboarding data, including CPF/CNPJ and billing address, but it provides no warning about handling sensitive personal and business information. In an agent skill context, that omission increases the risk that downstream agents or users will retrieve, display, log, or persist regulated data without appropriate privacy safeguards or least-privilege justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This documentation describes an operation that enables holiday mode, which blocks new customer orders, but it does not prominently warn about the business-impacting consequence at the point of use. In an agent skill context, missing operational safeguards can lead to accidental store disruption if a user or downstream agent triggers the action without understanding that order intake will be stopped.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions direct an operator to collect and use a user's phone number with a registration script, but they do not require explicit user consent, provide a privacy notice, or describe how the number and returned data will be handled. In a support/onboarding workflow, this creates a real privacy and compliance risk because an agent may process personal data without informed authorization or adequate safeguards.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

ensure_auth_skill_available() launches check_auth_dependency.py using subprocess.run(). For a skill whose declared role is forwarding Shopee Shop API operations, spawning another process is not an obvious or declared capability; it goes beyond straightforward API invocation and dependency checking could be handled in-process.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_shopee_shop_common.py (reported line 41)May include surrounding context.

python

print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr)
        sys.exit(DEPENDENCY_EXIT_CODE)
    try:
        result = subprocess.run(
            [sys.executable, str(checker)],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring and stderr message are written only in Chinese, and later comments/docstrings in the file continue this pattern. The policy allows locale constraints only when users are given a choice or the constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code probes several writable filesystem locations and creates directories/files unrelated to simply proxying Shopee shop APIs. This broadens the skill from network forwarding into local data placement, which can leak sensitive output into shared or unexpected locations such as the working directory, home directory, or temp space where other users or processes may access it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The helper unconditionally serializes and saves full API responses to local disk, even though the skill is described as forwarding Shopee shop info/settings APIs. Those responses can contain shop profile data, warehouse addresses, reseller brand info, KYC-related details, tokens, or other sensitive metadata, creating unnecessary local persistence and possible data exposure beyond user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing help/log strings are written in Chinese, which effectively constrains the skill's interaction language. There is no indication that users may select another language or that the Chinese-only behavior is a documented, justified locale restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file performs SMS-based LinkFox login, token exchange, user/team discovery, and API token generation, none of which are necessary for calling Shopee shop info/settings APIs through the declared developer proxy. This creates a high-risk credential-handling surface and suggests the skill may be collecting or minting credentials for a different platform than the one users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents use of an Authorization header carrying LINKFOXAGENT_API_KEY, which is a sensitive credential. The file does not include any warning about keeping the key secret, avoiding sharing it, or handling it securely, despite describing a security-relevant operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents the skill instructions and operational details almost entirely in Chinese, which effectively forces a specific language for users consuming the skill documentation. The policy requires flagging language or locale constraints when they are imposed without user opt-in or a documented justification.

Content

No source excerpt is available for this finding.