Shopee-店铺优惠券

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.5

Overview

The skill is a real Shopee voucher tool, but it also handles login, API-key, payment, and persistent response storage in ways that need careful review before installation.

Install only if you are comfortable with a skill that can change live Shopee voucher campaigns, guide users through LinkFox login and payment flows, and save full API responses locally. Use a dedicated API key, verify the LinkFox endpoint environment variables before use, avoid entering SMS codes unless you intend to create or recover credentials, and manually confirm voucher deletion/end/order actions before running them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The POST target URL is derived from environment-configurable base URLs, so an attacker controlling the runtime environment can redirect login and token-exchange traffic to an arbitrary host. Because these requests can carry phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys, this becomes an exfiltration and credential-theft risk rather than a harmless configuration feature.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: The gateway request uses a URL built from environment-controlled base configuration and sends the LinkFox API key in the Authorization header. If the environment is manipulated, the CLI will transmit that credential and related billing/order data to an attacker-controlled endpoint, enabling credential capture and abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises executable capabilities including environment-variable access, shell invocation, network access, and file writes, but does not declare permissions or constrain their use. In an agent setting, hidden or undocumented capabilities reduce user visibility and policy enforcement, increasing the chance of unintended data access, external calls, or filesystem persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is Shopee voucher management, but the referenced behavior includes LinkFox account login, SMS code handling, API key generation, account lookup, plan purchase, and payment QR/order workflows. This is a significant scope expansion into identity, billing, and payment operations, which could trigger sensitive account or financial actions under the guise of a voucher tool.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The file states earlier that tool use consumes credits and retries should be limited due to extra cost, but later claims '不消耗积分' ('does not consume credits'). Contradictory billing semantics can mislead users or the agent into making repeated calls, causing unanticipated charges or bypassing intended cost-safety behavior.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The onboarding document adds account registration, login, API-key setup, and paid billing workflows that are outside the stated scope of a Shopee voucher-management skill. This expands the skill’s operational surface into identity, credential, and payment handling, increasing the chance that an operator is guided into collecting secrets or personal data under the guise of using an unrelated feature.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper adds persistent local archival of full API responses, session metadata, and indexes even though the skill's purpose is voucher API forwarding, not local data retention. Voucher and shop-management responses may include identifiers, operational data, or tokens proxied from upstream systems, so silently storing them on disk increases exposure to later disclosure from other local processes or users.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The code probes and writes across multiple candidate filesystem roots including the current directory, home directory, ACPX workspace, and temp directory, which is broader than necessary for voucher API forwarding. This behavior increases the chance of leaving sensitive response artifacts in shared or weakly protected locations, especially temp directories and user workspaces.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key issuance, subscription discovery, ordering, and payment QR generation, which are unrelated to Shopee store voucher management. Scope drift of this magnitude is dangerous because it introduces credential handling and commerce flows that users would not expect from a voucher skill, increasing the chance of phishing, unauthorized account actions, and misuse.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Billing and payment-order creation are unjustified for a Shopee voucher-management skill and allow the component to initiate purchases and render payment QR codes. In this context, the mismatch makes the behavior more dangerous because users may trigger unrelated financial operations under the guise of store-voucher management.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The CLI can send SMS verification codes, log users in, and retrieve or generate LinkFox API tokens, which is outside the stated Shopee voucher scope. This is dangerous because it collects authentication factors and outputs long-lived credentials, enabling account takeover or unauthorized downstream API use if abused or socially engineered.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger is defined so broadly that it may activate even when the user only generally discusses Shopee store activity, not voucher management specifically. Over-broad invocation can route unrelated requests into a skill that has destructive voucher-management actions and external API/file-writing behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill exposes destructive operations such as delete_voucher and end_voucher without prominent warnings or confirmation requirements. In an agent workflow, this increases the risk of accidental termination or deletion of active promotions, with direct business impact on a merchant store.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation exposes a live voucher-creation workflow and explicitly tells the caller to pass the full body to the production-facing proxy, but it provides no warning, confirmation requirement, or indication that the action mutates real shop data. In an agent setting, that omission increases the chance of unintended creation or modification of promotional vouchers, which can cause business, financial, or operational harm if invoked from ambiguous user requests.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This documentation exposes a destructive operation that deletes vouchers but provides no warning, confirmation requirement, or operator-safety guidance. In an agent-driven context, that omission increases the chance of accidental or unauthorized destructive actions, especially when the skill is triggered broadly for voucher-management requests.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation exposes a destructive operation that can terminate active store vouchers early, but it does not warn users about business consequences, authorization sensitivity, or the need for explicit confirmation before execution. In the context of an agent skill that triggers on voucher-management requests, missing guardrails increases the chance of accidental or socially engineered misuse that could disrupt promotions and sales.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly tell operators to solicit a user’s phone number and use it in a scripted registration/login flow, but provide no consent, minimization, retention, or privacy guidance. In skill context, this is more dangerous because the skill is supposed to manage Shopee vouchers, so requesting phone numbers is unexpected and can normalize unnecessary collection of personal data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs users to persist API keys in shell startup files such as ~/.zshrc and ~/.bashrc without warning about credential exposure, shared-account risk, shell history leakage, or safer secret-storage options. Because this skill is not primarily an auth/bootstrap tool, embedding persistent credential setup here broadens the blast radius if the instructions are copied into insecure or multi-user environments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code writes full serialized API responses to disk and may also print them inline without any warning or consent at the point of output. Because voucher-management responses can contain business data and possibly credentials or tokens returned by the proxy layer, this creates a realistic confidentiality risk through local logs, terminal scrollback, or persisted files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The tool returns the generated API key directly in stdout JSON, which is commonly captured by agent logs, transcripts, shell history, or calling applications. Exposing a reusable credential this way materially increases the risk of credential leakage and unauthorized API access.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The instruction to always persist full API responses in session-linked local files can retain store, voucher, operational, or potentially account-related data longer than necessary. Persistent local storage increases exposure through later agent access, workspace sharing, backups, or accidental inclusion in context and logs.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The session logging layer persistently stores full API responses, updates metadata indexes, and may emit entire responses inline, creating durable data retention beyond the minimum needed to fulfill a voucher API request. In the context of an e-commerce store-management skill, this can expose commercially sensitive data, user/shop identifiers, and potentially secrets to anyone with local filesystem or console access.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 86% confidence
• Finding: This code transmits sensitive onboarding and authentication data to external services using requests.post. External transmission alone is expected for API clients, but in this file it is security-relevant because the destination is environment-configurable and the payload can contain SMS login data and tokens.

Static analysis

No suspicious patterns detected.