Temu欧洲站-广告

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:27 AM UTC
• Version: 1.0.5

Overview

This skill is mainly a Temu EU ads gateway, but it also includes broad token handling, generic proxying, persistent response storage, and account/payment onboarding that users should review carefully before installing.

Review this skill before installing. Use it only if you are comfortable sending LinkFox and Temu merchant credentials through the LinkFox gateway, storing Temu access tokens and full API responses locally, and allowing scripts that can modify ads, budgets, and ROAS. Avoid using the generic proxy for non-Ads APIs unless that broader access is intentional, and do not set gateway override environment variables unless you fully trust the destination host.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes meaningful capabilities—environment variable access, network access, and filesystem writes—without any declared permissions boundary. That makes it harder for users or hosting systems to understand and constrain what the skill can actually do, especially since it handles API keys, access tokens, and response persistence. In this context, the undeclared capability set increases the chance of overbroad execution and accidental sensitive-data handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest presents the skill as a Temu EU Ads wrapper, but the documentation exposes substantially broader functionality: generic proxying, multi-site file download, token storage/retrieval, auth guidance, token checking, and account onboarding/payment flows. This mismatch is dangerous because users may authorize or invoke the skill under a narrower trust assumption than its actual operational scope, enabling unexpected access to credentials, broader APIs, and local data persistence.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill documentation includes local saving, listing, and retrieval of Temu access tokens, which goes beyond simple Ads API forwarding. Persisting and reusing tokens locally creates a credential-handling surface that can expose secrets to other processes, users, or future sessions if storage protections are weak or undocumented.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: Although positioned as an Ads-focused EU skill, the documentation advertises generic multi-site proxy and file-download gateway behavior. That broader gateway capability can be used to reach non-Ads or non-EU functionality, weakening scope controls and making it easier to misuse the skill as a general API transport channel.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The access-token guide includes workflows for product/inventory and order/shipping tokens even though this skill is described as an EU Ads skill. That broadens the operational scope and may enable an agent or user to obtain and use credentials for unrelated Temu capabilities, increasing the chance of privilege misuse or cross-domain data access. In this skill context, the mismatch is more dangerous because ad tooling should not normalize access to order or inventory permissions.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The examples demonstrate calling product-related APIs such as category mapping through this skill tooling, which is outside the stated advertising purpose. This can encourage use of the skill as a general Temu proxy and blur authorization boundaries, making it easier to perform unintended non-ads actions with stored credentials. The context makes this more concerning because the skill trigger and description position it as ads-only.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper persistently writes full API responses to local disk under a session archive, even though the skill is described as an ads API gateway rather than a data archival tool. Ads API responses can contain campaign performance data, store identifiers, access tokens echoed by upstream systems, or other sensitive business information, so indiscriminate persistence increases confidentiality and retention risk.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This code creates a local session archive, metadata index, and usage history unrelated to the narrow function of forwarding Temu ads API requests. That extra collection layer expands the data footprint and can expose user activity, response contents, and file locations to other local processes or later unintended reuse.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is explicitly documented to retrieve access tokens for arbitrary purposes, including the example value "product-inventory" and the default fallback, even though the skill is described as EU Ads-only. That creates an authority/scope mismatch: a caller using this skill can obtain credentials for non-ads domains from the same local token store, expanding access beyond the declared capability boundary.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key issuance, package purchase, and payment handling, which materially differs from the declared Temu EU Ads integration purpose. Such scope mismatch is dangerous because users invoking an ads skill would not reasonably expect identity verification, credential provisioning, and commerce flows, increasing the risk of deceptive credential collection and unauthorized billing.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The order creation and QR payment functionality introduces commercial transaction capability unrelated to a Temu EU Ads API skill. In this context, hidden purchase flows are especially risky because they can lead to unexpected charges, social engineering, or abuse of trusted skill execution to initiate payments under misleading pretenses.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script performs SMS-based login and API-key provisioning for LinkFox accounts, which is outside the advertised Temu EU Ads feature set. In this context, collecting login factors and minting API keys is more dangerous because users may be tricked into granting broad platform access when they expected only an advertising integration.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script’s documented inputs explicitly allow arbitrary `site` values such as `cn` and arbitrary `tokenPurpose` values such as `product-inventory`, which exceed the stated scope of an EU Ads-only skill. In an agent environment, this broad credential-handling capability can be used to persist tokens for unrelated Temu domains or business functions, undermining least privilege and enabling cross-scope misuse if the skill is invoked outside its declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The call to `save_token(...)` persists a reusable access token together with flexible metadata (`store_key`, `site`, `management_type`, `token_purpose`, `label`) without any visible restriction tying storage to EU Ads workflows. Because the skill manifest is narrowly scoped to Temu EU Ads, storing reusable credentials for unrelated Temu domains creates an unnecessary privilege bridge that could let other operations reuse a token beyond the advertised trust boundary.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This script exposes a generic signed-file download path even though the skill metadata describes an Ads-focused capability set. A file download primitive can expand the skill’s effective authority beyond ad-campaign operations, potentially enabling retrieval of arbitrary signed resources if an attacker can supply or influence the URL or token context.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script forwards a user-supplied `type` and arbitrary `params` directly to a generic Temu proxy endpoint, while the skill metadata says it should only handle Temu EU Ads functionality. This creates a scope-break vulnerability: callers can invoke non-ads Temu APIs, including goods-management style endpoints shown in the example, potentially granting access to unrelated capabilities through this skill.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module docstring states this is a general Temu API proxy and even demonstrates a goods/category mapping call, which contradicts the skill’s declared EU Ads-only purpose. This mismatch is dangerous because it signals and encourages broader use of the proxy, increasing the likelihood that operators or downstream agents invoke unauthorized non-ads APIs through this skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that it always writes full API responses to local files, yet does not clearly warn users that those responses may contain sensitive business data, identifiers, or even credential material. Silent persistence increases the risk of accidental disclosure through shared working directories, backups, logs, or later inspection by other tools.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document recommends storing long-lived access tokens in a local JSON file but does not warn about credential sensitivity, file permissions, backup/sync leakage, or multi-user host exposure. This increases the risk of token theft from disk, especially on shared machines or developer environments, leading to unauthorized Temu API access. In this context, the danger is meaningful because these tokens grant business API capabilities and are manually copied, so compromise directly exposes account operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document exposes destructive and financially impactful operations such as delete, pause, open, budget modification, and ROAS modification, but it does not include an explicit warning, confirmation requirement, or operator-safety guidance. In an agent skill context, this increases the chance that an automated workflow or inattentive user could trigger irreversible ad changes or spend-impacting actions without realizing the consequences.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to manually copy an access token from the seller backend and optionally save it to a local store, but provides no safeguards for handling a highly sensitive bearer credential. In this skill context, the token appears to grant access to Temu seller APIs for ads and related business operations, so leakage through clipboard history, screenshots, logs, local files, or insecure storage could enable unauthorized API access and account misuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The onboarding flow explicitly instructs collecting a user's phone number and submitting it to a local script for registration/login, but it does not provide any privacy notice, consent language, retention limits, or guidance on how the phone number and verification code are handled. In a support/onboarding context, this can lead to unnecessary collection of sensitive personal data and creates risk of misuse, leakage, or non-compliant handling.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explicitly states that this skill proxies EU Ads API calls via `temu_eu_proxy` and defaults to `site=eu` and `tokenPurpose=product-inventory`, but it does not warn that requests will transmit merchant account data to an external gateway or that some operations can create/modify ads, budgets, bids, and reporting state. In an ad-management context, omission of these warnings increases the risk of users or downstream agents triggering account-impacting actions without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.