Temu全球站-广告

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:27 AM UTC
• Version: 1.0.5

Overview

This Temu ads skill has legitimate ads functionality, but it also includes broad proxying, credential storage, response logging, and onboarding/payment actions that warrant review before installation.

Install only if you are comfortable giving this skill access to LinkFox and Temu credentials, local token files, local saved API responses, and live ad-management actions. Before use, avoid storing tokens in shared or synced directories, review or disable automatic response persistence if possible, verify gateway URLs are the official LinkFox hosts, and require explicit human confirmation before creating, deleting, pausing, reopening, or changing budgets/ROAS for ads.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes environment-variable access, local file writes, and outbound network access, but does not declare these capabilities or present them as explicit permissions. That reduces transparency and informed consent, especially because the documented behavior includes persistent storage of API responses and use of authentication tokens against external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a Temu Global Ads wrapper, but the documented behaviors extend into generic proxying, token storage/retrieval, account onboarding, API key generation, billing/package purchase, and payment status functions. This scope expansion is dangerous because users or calling agents may invoke a narrowly trusted Ads skill while actually granting access to broader account, credential, and transactional operations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Documenting local save/read/list operations for Temu access tokens introduces credential persistence beyond the stated Ads-forwarding purpose. Persisted tokens can be exposed to other local processes, future sessions, or accidental inclusion in project artifacts, increasing the chance of account compromise.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims an Ads-specific scope but also documents a generic multi-site proxy and file-download capability, enabling broader access than users would reasonably expect from the name and description. Generic proxy functionality can be repurposed to reach unintended endpoints or manipulate other Temu domains/features outside the reviewed Ads surface.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The document describes an ads/logs endpoint but explicitly recommends `tokenPurpose=product-inventory`, which can blur authorization boundaries between product-management and ads scopes. In a gatewayed integration, this kind of scope mismatch can cause overbroad token reuse, accidental privilege escalation, or access-control bypass if the backend validates only the token purpose loosely or inconsistently.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly recommends using `tokenPurpose=product-inventory` for an ads reporting endpoint, creating a scope mismatch between the skill’s advertised ads-only purpose and the credential purpose being requested. This can enable use of a broader or unrelated token than necessary, weakening least-privilege controls and potentially allowing cross-domain data access if callers reuse higher-privilege inventory tokens with this ads workflow.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The helper adds behavior well beyond simple API forwarding by automatically persisting full API responses and session metadata to local disk under multiple candidate directories. Because Temu/LinkFox responses can contain tokens, account identifiers, reports, business data, or other sensitive content, this creates unintended at-rest exposure and increases the blast radius if the host is shared or later compromised.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: This file implements account onboarding, package listing, purchasing, payment QR generation, and order querying, which are unrelated to a Temu Global Ads API forwarding skill. Such capability mismatch is dangerous because users invoking an ads skill may be socially engineered into disclosing phone numbers, SMS codes, or making payments to obtain unrelated platform access.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The business logic in this section fetches LinkFox user info, packages, and creates or queries orders rather than interacting with Temu Global Ads endpoints. In the context of a Temu Ads skill, this hidden repurposing materially increases risk because it enables monetization and account operations outside the declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The login flow sends SMS codes and then retrieves or generates a LinkFox API key, which is not a Temu Ads operation. In this skill context, that is dangerous because it can harvest authentication factors and convert them into reusable platform credentials under the guise of an unrelated ads integration.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This script implements a generic signed-file download capability, but the skill manifest describes a Temu Global Ads integration focused on ad campaigns, groups, creatives, bids, budgets, and reports. Scope expansion to arbitrary file retrieval increases attack surface and can enable unintended access to signed resources or data exfiltration workflows that users and reviewers would not reasonably expect from an ads-only skill.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: This script exposes a signed file-download capability through `global_file_download_call(params)`, which appears broader than the skill’s declared Temu Ads/API-management scope. If the upstream endpoint can fetch arbitrary signed URLs or files tied to the partner account, users may retrieve sensitive exports, reports, or other data not clearly covered by the skill manifest, creating a scope-expansion and data exfiltration risk.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script is advertised and scoped as a Temu Global Ads proxy, but it accepts an arbitrary user-supplied `type` and forwards it directly to the backend proxy without restricting it to ads-related endpoints. This creates a scope-bypass risk: a user can invoke non-ads Temu APIs through a skill that should only expose advertising operations, potentially reaching product, order, or other sensitive partner APIs if the upstream token and gateway permit them.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The module documentation and usage example demonstrate a non-ads goods API (`bg.goods.category.mapping`) even though the skill is described as ads-only. This is dangerous because it signals and normalizes cross-scope use, making misuse more likely and reinforcing that the proxy can be used for unrelated Temu APIs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that complete API responses are automatically written to disk, but it does not present this as an explicit user warning or consent gate. Since those responses can contain tokens, store identifiers, campaign data, or business-sensitive reporting, silent persistence increases the risk of unintended disclosure and long-lived local data exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document recommends saving Temu access tokens to a local JSON file and shows commands that persist raw credentials, but it does not clearly warn that these tokens are sensitive secrets requiring restricted file permissions, encryption, redaction, and exclusion from source control or shared environments. If a user follows this guidance on a multi-user machine, synced home directory, CI runner, or compromised workstation, the token can be stolen and used to access Temu business APIs and perform unauthorized operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly presents a workflow for creating, modifying, pausing, and deleting ads, but it does not warn that these actions can spend money, alter live campaigns, or be difficult to reverse. In an agent skill context, that omission increases the chance an agent will perform financially or operationally impactful actions without explicit user confirmation, especially because the skill is designed to trigger on ad-management requests.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document exposes a destructive modification endpoint that supports delete, pause, reopen, budget, and ROAS changes, but it provides no operator-safety guidance such as confirmation requirements, scope checks, or warnings about irreversible business impact. In an agent skill, this increases the chance of unsafe automation or accidental execution of high-impact ad changes from ambiguous user requests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to copy an access token from the seller backend and optionally write it into a local store, but it does not warn that the token is a sensitive credential equivalent to account access. In an authorization-flow document for ad and store management APIs, this omission increases the chance users will mishandle, persist insecurely, or expose the token in logs, screenshots, shared machines, or local files.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide tells the operator to collect a user's phone number and drive a registration/login flow, but it provides no privacy notice, consent language, retention limits, or handling restrictions for that personal data and OTP-like verification data. This creates unnecessary risk of improper collection, exposure, or misuse of sensitive account onboarding information.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guide explicitly tells users to copy an access token and save it with another script, but it does not warn that the token is a sensitive credential requiring secure storage and handling. In an agent skill context, this increases the chance that operators persist tokens insecurely, expose them in logs, or share them across environments, which could enable unauthorized API access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The emit_result function writes complete serialized API responses to disk and prints the save path without any consent gate or warning, even when responses may include sensitive commercial data or authentication-related fields. In a shared workstation, CI runner, or agent environment, these files may be accessible to other users, tools, or later processes, causing unintended data leakage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Access tokens are serialized to a predictable local JSON file in plaintext with no warning, encryption, or permission hardening. On multi-user systems or environments with backups, sync tools, or broad file access, this can expose reusable bearer tokens and enable unauthorized API access.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.