Shopee-店铺视频

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.5

Overview

The skill performs Shopee video operations, but it also adds account login, API-key generation, billing/order creation, automatic feedback reporting, and broad local persistence that need careful review before use.

Install only if you are comfortable with this skill handling LinkFox account setup, phone/SMS authentication, API keys, Shopee shop/video data, local response files, automatic feedback calls, and billing order creation. Before use, pin endpoints to trusted LinkFox HTTPS hosts, avoid sharing SMS codes through the agent unless you trust the workflow, review any delete/edit/post/order action before execution, and clean up persisted response files and shell-profile API keys when no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:119

Finding

Mandatory Automatic Feedback Transmission Without Explicit User Consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_video_common.py:19

Finding

Credential-Bearing Requests Can Be Redirected to Environment-Controlled Destinations

Content

View full analysis

dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` Onboarding similarly permits replacement of multiple credential-bearing destinations: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` Access tokens and derived user identity are attached to requests: ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: """构造带浏览器指纹的 headers；acc ...[truncated 3051 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_shopee_video_common.py:218

Finding

Unsanitized Session Identifier Enables Arbitrary Response-File Placement

Content

View full analysis

str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox")) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root ``` The session identifier is accepted without validation: ```python def _lf_session_id(ts: float) -> str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` It is then incorporated directly into filesystem paths before the complete API response is written: ```python def emit_result(result, slug=SLUG, inline=False): """落盘完整响应到 linkfox///data/-.json；大响应只打印摘要。无缓存。""" serialized = json.dumps(result, ensure_ascii=False, ...[truncated 2962 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/onboarding.py:288

Finding

Bundled Account and Payment Operations Exceed the Core Video Skill's Least-Privilege Scope

Content

View full analysis

dict: if method not in PAY_METHOD_MAP: raise ValueError(f"不支持的支付方式 {method}，仅支持 wechat/alipay") user = fetch_user_info() is_team = bool(user.get("isTeamUser")) member_id = _jwt_uid().get("uid", "") if not member_id: raise RuntimeError("无法从 JWT 解出 uid，请检查 LINKFOX_AGENT_API_KEY 或 LINKFOXAGENT_API_KEY") body = { "packageId": plan_id, "payType": PAY_METHOD_MAP[method], "payDeviceType": "PC", "memberId": member_id, "groupId": user.get("currentGroupId", ""), } path = "/order/createTeamOrderByAPI" if is_team else "/order/createByAPI" print(f"{TAG} 下单 path={path} isTeamUser={is_team} groupId={body['groupId']}", file=sys.stderr) resp = _check_biz(_gateway("POST", path, body), "下单") return { "order_id": resp.get("orderId", ""), "qr_content": resp.get("payQrcode") or resp.get("payUrl", ""), "pay_url": resp.get("payUrl", ""), "pay_price": resp.get("payPrice", ""), "original_price": resp.get("originalPrice", ""), "discount_price": resp.get("discountPrice", ""), "state": resp.get("state", ""), "time_left": resp.get("timeLeft", 0), "expire_date": resp.get("expireDate", ""), "trade_no": resp.get("tradeNo", ""), "product": resp.get("product", ""), "pay_type": resp.get("payType", ""), } ``` The registration workflow logs in, forwards tokens, retrieves team information, and obtains or generates an API token: ```python def login_and_get_key(phone: str, code: str, channel: ...[truncated 4121 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (48)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, API keys, and user identifiers to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication and token-generation traffic to attacker-controlled infrastructure and exfiltrate credentials.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The gateway helper composes outbound URLs from environment-derived base addresses and attaches the LinkFox API key in the Authorization header before calling urlopen. An attacker who can modify the environment can redirect billing, account, or package-management requests to a rogue server and capture the API key or manipulate commerce-related flows.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to be for Shopee video management but appears to include SMS login, token exchange, API key generation, account info retrieval, package listing, payment order creation, QR rendering, and order status checks. Combining commerce/payment/account functions into a differently labeled skill is dangerous because it obscures sensitive actions and may induce users to trigger credential or billing workflows unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to be for Shopee video management but appears to include SMS login, token exchange, API key generation, account info retrieval, package listing, payment order creation, QR rendering, and order status checks. Combining commerce/payment/account functions into a differently labeled skill is dangerous because it obscures sensitive actions and may induce users to trigger credential or billing workflows unintentionally.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to be for Shopee video management but appears to include SMS login, token exchange, API key generation, account info retrieval, package listing, payment order creation, QR rendering, and order status checks. Combining commerce/payment/account functions into a differently labeled skill is dangerous because it obscures sensitive actions and may induce users to trigger credential or billing workflows unintentionally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file documents a delete_video capability even though the skill metadata says it proxies the Video module’s 15 interfaces and names examples that do not include deletion. This creates a scope mismatch that can expose a destructive action to users or upstream agents that did not expect it, increasing the chance of unauthorized or unintended content deletion.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements SMS login, API key retrieval/generation, plan listing, order creation, payment QR generation, and order-status queries, which are unrelated to the declared Shopee store video capability. Hidden onboarding, account, and billing logic materially expands the skill's privilege surface and can collect or use credentials and payment operations outside the user-expected scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The operational behavior of the script centers on LinkFox platform account and commerce actions rather than Shopee video API forwarding promised by the skill metadata. This mismatch is dangerous because reviewers and users may authorize the skill expecting limited Shopee video actions while the code can perform authentication, token issuance, and payment-related operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares no explicit tool scope despite instructing use of environment variables, local file writes, shell execution, and network access. Missing least-privilege boundaries increases the blast radius if the skill is misused, modified, or triggered unexpectedly, because it can access more capabilities than users may realize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger logic is overly broad and allows activation even when the user does not explicitly mention video, making accidental invocation more likely. In a skill with network access, file writes, and potential account-scoped operations, over-triggering can cause unintended data access, API calls, or persistence of sensitive responses.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Contradictory statements about whether the tool consumes credits undermine informed consent and can lead users to approve operations under false cost assumptions. In transactional or metered environments, inaccurate billing disclosures create trust and abuse risks, especially if retries or additional calls are later encouraged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill always writes full API responses to local files but does not prominently disclose this in the user-facing description. Undisclosed persistence of raw responses can expose shop identifiers, analytics, tokens, or other sensitive business data to later access on the host system.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Always storing complete API responses in session-scoped files retains more data than is necessary for the immediate task and increases exposure duration. Because this skill handles shop-scoped video and performance data, local persistence can create unnecessary leakage risk through shared workspaces, backups, logs, or later tooling access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation exposes destructive and state-changing actions such as delete_video, edit_video_info, and post_video without any warning, confirmation guidance, or mention of irreversible business impact. In an agent setting, this increases the chance that automation or a misinterpreted user request causes unintended publication, modification, or deletion of store content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 85)May include surrounding context.

---

curl 示例

bash

export KEY=${LINKFOX_AGENT_API_KEY:-$LINKFOXAGENT_API_KEY}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation presents a destructive delete operation as a normal POST call and gives execution examples without any warning, ownership check guidance, or confirmation requirement. In an agent setting, this makes accidental or prompt-induced deletion more likely, especially because the skill is meant to operate on authorized stores and could directly affect production business content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s instructional content and field descriptions are written in Chinese throughout, while the document does not state that the skill is region-specific or provide any opt-in or alternative language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file’s instructional content and field descriptions are presented primarily in Chinese, which effectively forces a specific language for users consuming the skill documentation. The policy allows locale or language constraints only when the skill offers user choice or clearly documents a justified regional limitation, neither of which appears here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The onboarding document introduces authentication recovery, phone-based account registration, and billing/payment workflows that are unrelated to the Shopee store video skill's stated purpose. This expands the skill's operational scope into account lifecycle and payment handling, increasing the chance of misuse, user confusion, and unsafe collection of credentials or billing data through an unexpectedly privileged side path.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs operators to drive phone-based registration, SMS verification, and paid plan purchase flows even though those capabilities are not justified by the Shopee video feature set. In context, this is dangerous because a content-management skill should not be a vehicle for collecting phone numbers, handling one-time codes, or initiating purchases, all of which create phishing and account-takeover risk if abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown tells operators to obtain or process a user's phone number and SMS verification code without any privacy, consent, retention, or trust-boundary guidance. This creates a clear social-engineering and privacy risk because users may be induced to share sensitive identity and authentication factors through a skill that is unrelated to identity onboarding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document provides commands that permanently modify shell startup files and environment variables but does not clearly warn users that these are persistent system changes. That can lead to unintended configuration drift, exposure of API keys in local profiles, and unsafe copy-paste execution by users who do not understand the consequences.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_shopee_video_common.py (reported line 42)May include surrounding context.

python

print(f"DEPENDENCY_MISSING: {json.dumps(payload, ensure_ascii=False)}", file=sys.stderr)
        sys.exit(DEPENDENCY_EXIT_CODE)
    try:
        result = subprocess.run(
            [sys.executable, str(checker)],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The call_api function sends JSON parameters and an Authorization API key to remote endpoints via HTTP POST. Although this module name suggests API use, the code itself lacks a user-facing warning, prompt, or explanatory comment/docstring disclosing that user-supplied identifiers and credentials are transmitted to an external service.

Content

No source excerpt is available for this finding.