Shopee-店铺精选

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.5

Overview

The skill performs Shopee Top Picks management, but it also includes account login, API-key generation, payment ordering, endpoint overrides, and local response storage that should be reviewed before installation.

Install only if you trust LinkFox with your Shopee store operations, LinkFox API key, phone/SMS login flow, and billing workflow. Before use, verify all LinkFox endpoint environment variables point to official LinkFox hosts, require explicit approval for add/update/delete and payment-order commands, and expect full API responses to be saved locally unless the skill is changed.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used to send login/account payloads with authorization-related headers. In a skill runtime, an attacker who can influence environment configuration can redirect requests to an attacker-controlled endpoint and exfiltrate SMS login data, access tokens, refresh tokens, or generated API keys.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway request URL is built from environment-controlled base configuration and used with an Authorization header carrying the agent API key. If the base URL is altered, the CLI can transmit the API key and account/order data to an attacker-controlled server, enabling credential theft and downstream account abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises and documents capabilities implying environment access, file writes, network calls, and shell execution, yet it declares no permissions or equivalent capability boundaries. This mismatch reduces transparency and makes it easier for an invoking agent or reviewer to underestimate what the skill can do, increasing the risk of unintended data access, filesystem modification, or outbound requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is limited to Shopee Top Picks management, but the static finding indicates the skill also includes account login, SMS verification, API key generation, account info retrieval, plan purchase, payment order creation, QR rendering, and payment status checks. That is a significant scope expansion into authentication and billing workflows, which can expose credentials, enable unauthorized purchases, or manipulate account state well beyond the user's expected intent.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill states both that use will consume credits and later that it does not consume credits. Contradictory billing semantics can mislead users and higher-level agents into taking actions they would otherwise avoid, potentially resulting in unexpected charges, repeated retries, or unsafe automation decisions around quota handling.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file is for a Shopee Top Picks skill, but the documentation redirects the agent into unrelated account onboarding, login, and billing flows for a different service. This creates a strong scope mismatch that could cause an agent to collect credentials or payment-related data and execute auxiliary scripts outside the user’s expected Shopee task, increasing the risk of phishing-like behavior and unauthorized account actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documentation is dominated by auth and billing remediation instructions instead of the Shopee Top Picks API behavior described in the manifest. In a security context, this mismatch is dangerous because an agent may be induced to perform unrelated operational tasks, including registration, login, and payment support, which broadens the attack surface and violates least functionality.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper persistently writes full API responses to local disk, even though the skill is described as an API proxy/manager rather than a data archival component. Those responses may contain shop identifiers, tokens, request/response payloads, or operational metadata, creating unnecessary local data exposure if the workspace, temp directory, or home directory is accessible to other processes or users.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a LinkFox onboarding, login, token issuance, plan purchase, and payment workflow that is unrelated to the declared Shopee Top Picks management purpose. That mismatch is dangerous because users invoking a Shopee store-management skill would not reasonably expect the skill to collect phone numbers, request SMS codes, mint API keys, or initiate billing actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The order creation, package retrieval, and payment QR rendering capabilities introduce billing behavior that is unjustified for a Shopee Top Picks proxy skill. In this context, hidden payment flows materially increase risk of deceptive charges, credential misuse, and unauthorized monetization under the guise of an unrelated e-commerce management tool.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code sends SMS verification codes, performs account login, fetches team info, and generates API tokens, all outside the stated Shopee Top Picks scope. In a skill ecosystem, this is particularly dangerous because it can bootstrap access to a user's broader LinkFox account and credentials without a clear business need tied to the declared skill behavior.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger conditions are broad enough to activate even when the user does not explicitly mention Top Picks, as long as the system infers related store-management intent. Overbroad invocation increases the chance of running the wrong skill in a sensitive commerce context, which can cause unintended reads, writes, or modifications to store merchandising data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill exposes update and delete operations for store content without documenting any confirmation or safeguard requirement. In a commerce-management setting, destructive actions can remove or alter live merchandising collections, leading to business disruption, mistakes at scale, or abuse if the skill is invoked accidentally or through ambiguous prompts.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This documentation exposes a destructive delete operation for Top Picks collections but does not warn the user that the action is irreversible or may remove storefront merchandising configuration. In an agentic context, missing deletion warnings increase the chance of accidental destructive actions, especially when the skill is triggered broadly for Top Picks management and relies on prior shop authorization.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instructions explicitly tell the operator to collect a user’s phone number and run registration/login commands, but provide no privacy notice, consent language, retention policy, or handling constraints. That exposes users to unnecessary personal-data collection and increases the chance of mishandling sensitive identifiers and authentication factors.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code writes complete API responses to disk without any indication in this file that users are warned or that persistence is optional. Silent local retention increases the blast radius of any sensitive response data by turning transient API output into recoverable local artifacts.

Static analysis

No suspicious patterns detected.