Shopee-店铺视频

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:49 PM UTC
• Version: 1.0.5

Overview

The skill mostly matches Shopee video management, but it also handles LinkFox login, API keys, payments, automatic feedback reporting, and local response storage in ways users should review carefully.

Install only if you are comfortable with this skill managing Shopee video content, saving full API responses locally, using LinkFox account credentials, and potentially guiding billing/payment flows. Before use, keep LINKFOX_* URL overrides unset unless you trust them, confirm any publish or delete action explicitly, avoid sharing OTPs/API keys casually, and periodically remove saved linkfox response files that contain store or analytics data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs, and this function can send sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to whatever endpoint those variables specify. In a skill execution environment where env vars may be platform-controlled or attacker-influenced, this creates an SSRF/exfiltration channel that can silently redirect credential-bearing requests off the intended LinkFox infrastructure.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway request URL is built from environment-derived base URLs and is used with an Authorization header sourced from LINKFOX_AGENT_API_KEY, so a hostile override can redirect authenticated requests and leak the API key to an attacker-controlled server. Because this path also performs account, package, and order operations, the issue enables both credential exfiltration and unauthorized backend interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises operational capabilities involving environment variables, shell execution, file writes, and network access without declaring permissions or clearly constraining them. This reduces transparency and weakens review boundaries, making it easier for risky behaviors such as unexpected data exfiltration, persistent local storage, or command execution to be introduced without user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is Shopee video management, but the behavior reportedly includes unrelated account login, SMS verification, plan listing, order creation, QR payment rendering, and payment-status queries. That mismatch is dangerous because it creates an unexpected pathway for credential handling and financial operations under the cover of a benign ecommerce video tool, increasing the chance of unauthorized account actions or deceptive invocation.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest says the skill is for Shopee video APIs, yet it also instructs the agent to call a separate Feedback API unrelated to that purpose. This creates an undocumented side channel where extra data about interactions may be transmitted beyond the user's requested task, violating least surprise and expanding outbound data sharing.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatically reporting user satisfaction, praise, dissatisfaction, or general observations is not necessary for managing Shopee store videos and can disclose user behavior and conversation-derived metadata without a clear operational need. Because the reporting is framed as automatic and non-interruptive, users may never realize their feedback or inferred sentiments are being transmitted externally.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: `emit_result()` serializes and writes full API responses to local disk and maintains an index/metadata trail under a predictable `linkfox/<date>/<session>/data` hierarchy. In the context of Shopee store/video APIs, responses may include store identifiers, access tokens, performance data, or other sensitive business data, creating unnecessary data at rest exposure beyond the declared proxying purpose.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The helper executes a separate local Python script (`check_auth_dependency.py`) as a subprocess, which introduces an additional executable trust boundary not inherent to Shopee video API proxying. If the local workspace or adjacent files are tampered with, this path enables execution of attacker-modified code before the main logic proceeds.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script exposes a destructive `delete_video` capability that is not disclosed in the skill metadata, which describes upload, listing, detail, cover, edit, and performance operations but does not mention deletion. This creates a scope mismatch that can surprise users, bypass expected review or policy controls, and enable unintended destructive actions against an authorized Shopee store if the skill is invoked through broader routing logic.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script exposes a Shopee Video API operation, get_user_demographics, that is not declared in the skill manifest’s described interface set. This creates a capability mismatch: users, reviewers, and policy controls may assume only the documented 15 endpoints are available, while the code enables access to additional demographic data that may be more privacy-sensitive.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements LinkFox onboarding, SMS login, API key issuance, plan listing, ordering, and payment QR generation, which is materially unrelated to the declared Shopee store video proxy skill. That scope mismatch is dangerous because it introduces credential handling and commerce capabilities users would not reasonably expect from a Shopee video-management skill, increasing the chance of deceptive collection of account data and abuse of platform permissions.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Billing and payment-order creation are unrelated to the stated Shopee video API proxy purpose and expand the skill into financial operations, including payment URL/QR generation. In a skill context, this is especially risky because users may invoke it expecting media-management actions, not purchase flows that could trigger charges or social-engineer payment.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code performs SMS-based login, token exchange, and API key generation for LinkFox accounts, which exceeds the declared Shopee video proxy capability and creates an unexpected credential-acquisition path. In this context, the mismatch raises the danger of phishing-like behavior because the skill can solicit phone numbers and verification codes while presenting itself as a Shopee video tool.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are overly broad, allowing activation even when the user does not explicitly mention video, as long as the request is loosely related to an authorized Shopee store. Overbroad triggering can cause the wrong skill to run, leading to unnecessary API calls, unintended data access, and accidental execution of capabilities the user did not clearly request.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill states that complete API responses are always written to local files, but it does not warn users that those responses may contain sensitive store identifiers, operational metadata, or analytics data. Silent persistence of full responses increases the risk of unauthorized local access, accidental inclusion in repositories, or later reuse outside the original task context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This documentation exposes a destructive delete_video action but provides no warning, confirmation requirement, or operator guidance to verify user intent before deletion. In an agent setting, that increases the risk of accidental or prompt-induced destructive actions against an authorized Shopee store, especially because the skill is designed to act on already-linked merchant accounts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation describes a publish/upload operation that can modify external Shopee store state, but it does not instruct the agent to obtain explicit user confirmation or warn that the action is state-changing. In an agent setting, this increases the risk of unintended video publication, accidental uploads, or automated misuse against an authorized store because the skill is designed to trigger on broad video-related requests.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions explicitly tell the agent to ask for a user's phone number and use it in a scripted registration flow, but they provide no privacy notice, consent language, retention limits, or guidance on safe handling of the OTP and account data. In an agent context, collecting phone numbers and verification codes without clear boundaries increases the risk of unnecessary sensitive-data exposure, social-engineering abuse, and accidental credential handling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code writes complete responses to disk and announces the saved path, but there is no visible disclosure, consent flow, or data minimization in this helper. This is risky because users invoking a Shopee video skill may reasonably expect API proxying, not local archival of potentially sensitive store/business data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The login command emits the obtained API key directly to stdout JSON, which is commonly captured by agent logs, terminal scrollback, orchestration systems, or calling tools. Exposing long-lived credentials through standard output materially increases the risk of accidental disclosure and later account compromise.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The instruction to always save complete API responses to session-linked files violates data minimization because it persists potentially sensitive user/store data regardless of whether it is needed for the immediate response. Session-linked retention also makes cross-task aggregation easier, which can amplify privacy impact if the workspace is shared, synced, or later inspected.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 78% confidence
• Finding: This code transmits data to external services using requests.post, and in this file those requests can carry sensitive identifiers, phone numbers, tokens, and login data. External transmission is expected for API clients, but here it becomes security-relevant because endpoint selection is partly environment-controlled and the transmitted data includes credentials.

Static analysis

No suspicious patterns detected.