Shopee-店铺信息

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:48 PM UTC
• Version: 1.0.5

Overview

This Shopee shop skill is review-worthy because it can change live store settings, persist sensitive shop/KYC data, and includes LinkFox account and billing flows beyond basic shop lookup.

Review this carefully before installing. Use it only if you trust LinkFox with Shopee shop data and account/billing workflows, avoid setting custom LINKFOX_* gateway URLs unless they point to a trusted HTTPS service, confirm any profile or holiday-mode change yourself before running it, and assume full API responses may be stored locally until you delete them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The code sends sensitive data, including login credentials, access tokens, refresh tokens, and generated API tokens, to URLs derived from environment-controlled base endpoints. If an attacker can influence LINKFOX_LOGIN_API_URL or LINKFOX_AGENT_USER_API_URL, the CLI will exfiltrate secrets to an attacker-controlled server. This is more dangerous because the file’s stated skill scope is Shopee store operations, but the code performs unrelated account onboarding and token issuance.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request path uses an Authorization header populated from environment-sourced API keys and sends it to a URL built from environment-controlled base configuration. If LINKFOX_AGENT_API_URL or LINKFOX_TOOL_GATEWAY is altered, the tool will disclose the API key and subsequent account/order data to an untrusted endpoint. Because this skill also exposes billing and order functionality unrelated to the declared Shopee purpose, the mismatch increases suspicion and blast radius.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and operationally relies on environment variables, shell execution, file writes, and network access, yet it declares no permissions. This creates a transparency and governance gap: an agent or reviewer cannot accurately assess what the skill can do, and the combination of network + shell + file_write materially expands blast radius if the skill is misused or compromised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The static finding indicates the skill's actual behavior extends beyond Shopee shop APIs into LinkFox account login, API-key generation/retrieval, billing, payment order creation, and payment status handling. That is a significant scope expansion touching authentication secrets and financial operations, which can trigger sensitive actions the user did not request and materially increase the risk of credential abuse, account takeover, or unauthorized purchases.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper automatically writes full API responses to local disk, including shop metadata and potentially sensitive proxy-returned content, even though the stated skill purpose is only to retrieve or update Shopee shop information. This creates unnecessary local persistence, increases exposure to other local users/processes, and can retain sensitive business data longer than intended.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, login, token generation, package purchasing, and payment flows instead of the declared Shopee shop information/settings functionality. Such capability drift is dangerous because users or orchestrators may invoke the skill expecting Shopee operations while the code collects credentials and performs unrelated privileged actions. The mismatch strongly suggests deceptive packaging or unauthorized scope expansion.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code creates orders, queries payment state, and renders payment QR codes, which are unrelated to Shopee shop info/settings. Hidden billing functionality can trick users or hosting agents into initiating purchases under the guise of store management, creating financial and trust risks. In the context of this skill, this is a materially dangerous scope violation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file performs SMS login, token exchange, team lookup, and API-key generation for LinkFox accounts, none of which is justified by a Shopee shop data/settings skill. This creates a credential-harvesting and privilege-expansion path hidden behind misleading metadata. The contextual mismatch makes the behavior substantially more dangerous than a standalone onboarding utility.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The module explicitly describes itself as a LinkFox onboarding CLI, contradicting the enclosing skill’s declared Shopee store functionality. This inconsistency is dangerous because it can conceal unexpected credential, token, and payment operations from users and reviewers. While not an exploit primitive by itself, it is a strong indicator of deceptive or unauthorized behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are intentionally broad, including cases where the user does not explicitly mention shop information as long as the request relates to an authorized Shopee shop. Over-broad routing can cause the wrong skill to activate for unrelated or more sensitive requests, increasing the chance of unintended API calls, unnecessary data exposure, or accidental configuration changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill includes state-changing operations such as update_profile and set_shop_holiday_mode, but it does not require an explicit confirmation step before execution. In this context, those changes can alter storefront identity or disable ordering, so accidental invocation could directly disrupt business operations and cause revenue loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly states this endpoint returns Brazil-only KYC and tax onboarding data, including CPF/CNPJ and billing address, but provides no warning about the sensitivity of that information or guidance on minimizing disclosure. In an agent skill context, this increases the chance the agent will fetch and surface regulated personal/business data to users without sufficient justification, redaction, or consent checks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly states that enabling `holiday_mode_on=true` blocks new orders, but it does not require or prominently warn about the operational/business impact before invoking the action. In an agent setting, this increases the risk of accidental disruptive changes to a live store, especially because the skill is designed to trigger on broad shop-setting requests and routes directly to a state-changing API.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation describes a live profile-modification endpoint and its writable fields, but it does not clearly warn that the action changes production shop data or require confirmation before use. In an agent-skill context, missing safety guidance can cause unintended destructive or business-impacting changes such as renaming a store, replacing its logo, or altering its public description.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs collecting a user's phone number and sending it to a registration/login script, but provides no user-facing consent flow, privacy notice, retention limits, or explanation of how the phone number and verification code will be handled. This creates a real privacy and data-handling risk, especially because the flow involves authentication and account creation for a third-party service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code silently persists response data to local files without explicit notice or consent, which can expose sensitive shop data, notifications, warehouse details, or KYC-related information to other local principals or later compromise. Because this helper is shared across shop APIs, the dangerous scope is broader than a single endpoint.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This script directly invokes a state-changing Shopee API to toggle shop holiday mode based solely on provided JSON arguments, with no confirmation, dry-run, or visible guardrail in this file. In an agent setting, that creates a real risk of unintended shop configuration changes if the tool is triggered from ambiguous user intent, malformed automation, or prompt-injection-influenced workflows.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This external transmission point posts potentially sensitive authentication material to remote services. In combination with environment-overridable endpoints, it becomes a concrete exfiltration risk because credentials and tokens may be sent to attacker-controlled infrastructure. The misleading Shopee skill context makes such outbound auth flows especially unsafe and unexpected.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 76% confidence
• Finding: The alternate environment variable path for API key retrieval increases the number of accepted secret sources and feeds the token into network requests and JWT parsing logic. While environment variables alone are not a vulnerability, in this context they participate in a broader secret-handling pattern that can expose credentials through misdirected requests. The scope mismatch of the skill makes this behavior more suspicious and risky.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 76% confidence
• Finding: The alternate environment variable path for API key retrieval increases the number of accepted secret sources and feeds the token into network requests and JWT parsing logic. While environment variables alone are not a vulnerability, in this context they participate in a broader secret-handling pattern that can expose credentials through misdirected requests. The scope mismatch of the skill makes this behavior more suspicious and risky.

Static analysis

No suspicious patterns detected.