Temu美国站-上架商品

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.6

Overview

This skill is mostly a Temu product-management integration, but it needs Review because it also handles account login, billing, broad proxy calls, and local plaintext credential/data storage.

Review before installing. Use this only if you trust LinkFox with Temu seller tokens, LinkFox API keys, phone-based login, and possible paid subscription order flows. Avoid setting gateway/auth URL override environment variables unless you control the destination, avoid unmasked token commands, and treat ~/.linkfox/temu-access-tokens.json plus saved linkfox response files as sensitive data that may need deletion or permission hardening.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from helper functions that read environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then used with requests.post to send SMS login data, access tokens, refresh tokens, and API-token generation requests. In a skill/runtime environment where env vars can be influenced by deployment or a malicious wrapper, this enables redirection of highly sensitive authentication material to an attacker-controlled endpoint.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is built from environment-controlled base variables and then requested with urlopen while attaching the LinkFox API key in the Authorization header. If an attacker can set LINKFOX_AGENT_API_URL or fallback variables, they can exfiltrate the API key and any order/account metadata to an arbitrary server under the guise of normal gateway traffic.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises capabilities to read environment variables, write files, and access the network, but does not declare permissions or constraints for those actions. That reduces transparency and weakens review boundaries, making it easier for sensitive data such as API keys or product data to be accessed or persisted unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is Temu US product publishing, but the detected behavior extends into LinkFox account login, SMS code handling, API key generation, subscription purchase, payment status checks, and QR code rendering. This scope expansion is dangerous because it enables credential handling and financial/account operations unrelated to the stated task, increasing the risk of unauthorized actions or user deception.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The documentation says the tool consumes credits and warns against repeated attempts, but later states that it does not consume credits. Contradictory billing guidance can mislead users into authorizing unexpected retries or purchases, especially in a skill already tied to account and package-related functionality.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The document explicitly states that `scripts/temu_us_proxy.py` can transparently forward arbitrary `type` values, which defeats the product-only scope described in the skill metadata. In an agent context, this broadens reachable functionality to undocumented or unrelated Temu APIs and can enable unauthorized actions or data access if callers can influence the proxied type.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file documents product editing and migration capabilities that exceed the skill’s declared 'Add Product' scope. This creates scope drift: an invoking agent or user may access higher-impact modification operations than expected, increasing the chance of unauthorized catalog changes, product tampering, or accidental use of destructive functions under an overly broad skill trigger.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The helper writes full API responses to local disk for every call, regardless of sensitivity. In a Temu product-management context, responses can contain access tokens, product data, pricing, inventory, or customer-linked metadata, so indiscriminate persistence expands the data exposure surface beyond the immediate API transaction.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code creates a reusable local storage hierarchy under shared locations such as the workspace, home directory, or temp directory, allowing response artifacts to accumulate across sessions. This introduces unnecessary cross-session data retention for a skill whose stated purpose is proxying Temu product API operations, increasing the chance of unintended access by other local users, processes, or later workflows.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This script exposes a capability to enumerate locally saved Temu access tokens even though the skill’s stated purpose is product-management API operations, not credential inspection. Credential-listing utilities increase the chance of secret discovery and misuse, and in an agent/tooling context they can be abused for reconnaissance prior to token theft or unauthorized API access.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring claims the script lists tokens in masked form, but the code accepts a user-controlled parameter `{"mask": false}` that can print unmasked access tokens. That creates a direct secret disclosure path: anyone able to invoke the script can exfiltrate valid credentials and then use them to access or modify Temu-linked resources through the gateway or partner APIs.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API key issuance, plan purchase, and payment support, which is materially unrelated to the declared Temu US product-publishing skill. Scope divergence is dangerous because users invoking a Temu product API skill would not reasonably expect account takeover-adjacent auth collection and billing behavior, increasing the risk of covert credential harvesting and unauthorized monetization.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The code can list purchasable plans, create orders, and render payment QR codes, all unrelated to Temu US product publishing. Embedding billing workflows inside an unrelated integration skill creates an opportunity for deceptive charges, social engineering, and abuse of the user's trusted execution context.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill performs SMS-based login and API key retrieval for LinkFox accounts even though its stated purpose is Temu add-product API access. This broader-than-declared capability increases the chance that the skill collects credentials or issues long-lived secrets under misleading context, which is especially risky in an agent ecosystem where users trust scope descriptions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script explicitly persists a generic Temu access token for later reuse in proxy and fileDownload flows, which is broader than the skill’s declared Temu US add-product purpose. Scope expansion around credential handling increases the chance of unauthorized cross-feature use and turns the skill into a reusable credential broker if the local token store is accessed by other components or users.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The save_token call gives the skill a local credential persistence capability that is not justified by the stated function of brokering product API requests. Unnecessary credential storage increases the attack surface: any compromise of the host, logs, backups, or adjacent tooling can expose reusable access tokens beyond the immediate transaction.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script exposes a stock quantity update operation (`bg.btg.goods.stock.quantity.update`) even though the skill metadata and manifest describe the skill as focused on Temu US Add Product functionality. This scope mismatch is dangerous because agents or users may invoke inventory-changing capabilities that were not declared, reviewed, or expected, leading to unintended stock manipulation and violating least-privilege expectations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that full API responses are always written into the current project directory by default, but does not require an explicit warning or opt-in for local persistence. In this context, responses may contain access tokens, inventory, pricing, category mappings, or other business-sensitive data, so silent persistence increases the chance of accidental exposure or later exfiltration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document encourages storing a live Temu access token locally and even provides a default file path, but it does not clearly warn that the token is a sensitive credential equivalent to account access. If that file is left with weak filesystem permissions, copied into backups, synced to cloud storage, or exposed on a shared machine, an attacker could reuse the token to access Temu product and inventory APIs through the skill workflow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs users to manually copy an access_token from the seller backend and optionally save it to a local store, but it does not include any guidance on secure handling, storage, masking, rotation, or scope limitation of this credential. In the context of a skill that proxies Temu Partner US product-management APIs, exposure of this token could grant unauthorized access to product, inventory, pricing, or account operations through the gateway.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The onboarding instructions explicitly tell the operator to collect a user's phone number and use it in registration/login flows, but provide no privacy notice, consent guidance, data minimization rules, or handling restrictions for this personal data. In a support/onboarding context, this increases the risk of unnecessary collection, mishandling, or disclosure of PII during account creation and authentication.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The file documents credential handling (`LINKFOXAGENT_API_KEY`, `accessToken`, `storeKey`) alongside arbitrary proxy and signed file-download capabilities, but provides no warning about sensitive data handling, overbroad access, or operational risk. In practice this normalizes powerful primitives without guardrails, increasing the chance an agent or user will expose tokens, proxy unsafe requests, or retrieve sensitive files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to manually copy an access token and save it with a script, but it provides no warning about treating the token as a secret, avoiding logs/chat paste, encrypting storage, or restricting access. In an agent-skill context, this is risky because users may expose long-lived seller credentials in conversational history, local files, or insecure stores, enabling unauthorized API access to product, inventory, or other merchant data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function saves complete API results to disk and may also print them inline without any warning or consent mechanism in this file. That creates a transparency and privacy problem because users may not realize sensitive Temu or LinkFox data is being retained locally or echoed to logs/stdout.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persists Temu access tokens to a local JSON file in plaintext without setting restrictive file permissions, encryption, or any user-facing notice that long-lived credentials are being stored on disk. On multi-user systems, shared environments, backups, or developer workstations with weak filesystem hygiene, this increases the risk of credential disclosure and subsequent unauthorized API access.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.