Shopify商品查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:39 PM UTC
• Version: 1.0.9

Overview

The skill can query Shopify products, but it also adds account login, API-key handling, saved results, and payment-order flows that need user review before installation.

Review this skill before installing. Only use it if you are comfortable sending Shopify search inputs, account phone/SMS login data, API keys, and possible billing actions to LinkFox services. Avoid custom LINKFOX_* endpoint overrides unless you control the destination, verify any plan and payment amount before creating an order, and prefer safer secret storage over writing API keys into shell startup files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 89% confidence
• Finding: The POST target is derived from environment-controlled base URLs and then used to send login and account data with requests.post. In an agent/runtime setting, environment variables are often configurable by deployers or wrappers, so this can redirect phone numbers, SMS codes, access tokens, and API-token operations to attacker-controlled endpoints, creating SSRF and credential exfiltration risk.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway URL is built from environment-derived base configuration and used by urlopen with the Authorization header populated from the API key. If an attacker can influence the environment, they can cause authenticated requests to be sent to an arbitrary host and capture the API key or trigger internal network access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises only Shopify product querying, but the file indicates operational capabilities involving environment access, file writing, and network use without any declared permissions boundary. Hidden or undeclared capabilities weaken reviewability and consent, and in this context could enable credential handling, local data writes, or outbound requests beyond what a user expects from a simple query skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to filter Shopify products, but also includes account login, API key generation, package purchase, payment QR creation, order-status polling, and team/account handling. That expands the trust boundary from read-oriented product search to authentication and financial operations, creating risk of credential collection, unauthorized purchases, and sensitive account actions under misleading pretenses.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements onboarding, SMS login, API-key retrieval, plan listing, and payment flows, which are materially unrelated to a Shopify product-query skill. Such scope expansion increases the attack surface and enables collection of credentials and billing actions users would not reasonably expect from the declared skill purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill can create orders and generate payment QR codes even though its manifest describes product querying. In this context, hidden billing capability is dangerous because it can prompt or facilitate purchases outside the user’s expected workflow and exposes financial operations that are unnecessary for the stated function.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code performs SMS login, token exchange, team selection, and API-token generation for a service account, all unrelated to Shopify product search. This is especially risky because it collects sensitive authentication factors and turns them into reusable API credentials within a skill whose declared purpose gives users little reason to expect such access.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The top-level documentation says the tool must not write to /tmp and should fail if the current directory is not writable, but the implementation silently falls back to the home directory and then the system temp directory. In an agent setting, that mismatch can cause sensitive API results to be persisted in locations the operator did not expect, weakening containment and increasing the chance of cross-session leakage or accidental exposure.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger text is overly broad, stating the skill should activate even when users do not mention the tool name as long as they discuss Shopify product searching or metrics. Overbroad invocation can cause unintended routing into a skill that also touches onboarding, balance, and payment-related flows, increasing the chance of accidental data disclosure or unexpected account actions.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: Forcing Chinese-language behavior without user opt-in is primarily a trust and usability issue, but it can become a security concern when consent, billing, or onboarding instructions are presented in a language the user may not understand. In this skill, that matters more because the documented flows include authentication and payment-related problem resolution.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs agents to send feedback content, including a free-form summary of user intent and actual results, to an external service without requiring user notice, consent, or data minimization. In an agent context, this creates a real privacy risk because operators may inadvertently transmit user prompts, business data, URLs, or other sensitive context to a third-party endpoint unrelated to the core Shopify query function.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions ask the user to submit a phone number to an onboarding script and potentially use it for registration/login, but they provide no privacy notice, consent guidance, retention limits, or indication of where that personal data is sent or stored. In a skill context, this creates unnecessary collection of personally identifiable information and increases the risk of mishandling or exposing user data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill tells users to persist an API key in shell startup files and environment configuration without warning that this stores a long-lived secret on disk and may expose it to other local users, backups, shell history, or accidental disclosure. While common operationally, embedding credential persistence instructions in a skill without safer handling guidance increases the chance of secret leakage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The generated API key is printed to stdout JSON, which may be captured by agent logs, transcripts, tool wrappers, or other downstream components. Exposing a reusable secret in normal command output materially increases the chance of accidental leakage and subsequent account misuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends user-supplied query parameters plus SESSION_ID, MODE_ID, and APP_NAME metadata to a remote service without an operation-site warning or consent checkpoint. In an agent workflow, that can leak sensitive business research inputs and internal session metadata to an external endpoint, especially because the gateway base URL is environment-configurable.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script writes full API responses to persistent local storage by default, including potentially sensitive product-query results and related metadata, without an explicit warning at the point of use. In shared workspaces or agent environments, default persistence increases the risk of later unintended access, retention beyond necessity, and aggregation of sensitive research data across sessions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.