Temu美国站-广告

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:29 AM UTC
• Version: 1.0.5

Overview

This Temu Ads skill is disclosed as an ads gateway, but it also exposes broad proxy, credential storage, full-response persistence, and account/payment flows that users should review carefully before installing.

Install only if you trust LinkFox's gateway and need this broad Temu/LinkFox workflow, not just a narrow ads helper. Use least-privilege Temu tokens, avoid storing tokens on shared machines, review `~/.linkfox` and `linkfox/` output files, confirm any ad deletion/budget changes or paid orders manually, and avoid passing arbitrary download URLs unless you know they came from Temu.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill exposes environment-variable access, network access, and local file writes without any declared permission boundary or user-visible capability scoping. In practice, this increases the chance that the skill can handle credentials and persist sensitive API responses in ways the caller did not explicitly authorize.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior substantially exceeds the advertised purpose of a Temu US Ads skill by including generic proxying, signed file download, token storage/retrieval, account onboarding, API-key management, and payment/order flows. This mismatch is dangerous because users or orchestrators may invoke the skill expecting a narrow Ads-only surface while actually granting access to broader account, credential, and billing operations.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill claims to be an Ads-focused integration but also documents local credential storage and token-management utilities. Mixing operational business functions with local secret lifecycle handling enlarges the attack surface and creates a greater chance of accidental credential exposure or misuse.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill is scoped as US Ads-specific, yet the documented gateway scripts support generic multi-site proxying. That broader capability can be abused to reach endpoints outside the intended scope, undermining least privilege and making policy enforcement harder.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper unconditionally serializes and saves full API responses to local disk, even though this skill is described as an ads API gateway/forwarder rather than a data archival component. Ads and gateway responses can contain access tokens, account identifiers, campaign data, error payloads, or other sensitive business data, so persistent storage materially increases confidentiality risk and retention beyond user expectation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This code creates a reusable cross-session archive structure under shared filesystem locations and maintains index metadata for later discovery of stored outputs. That behavior is not necessary for simple API forwarding and expands the attack surface by making prior session data easier to enumerate, correlate, and access from other processes or users on the same host.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The helper defaults token resolution to the "product-inventory" purpose even though the skill is described as an ads-only integration. That creates a scope-confusion risk where the skill may obtain or use a token intended for a different capability, weakening least-privilege controls and potentially enabling cross-scope API access if backend token enforcement is permissive.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The proxy helper accepts an arbitrary api_type and forwards it directly to the backend gateway, rather than enforcing a fixed allowlist of ads endpoints declared by the skill. In this skill context, that makes the helper more dangerous because the manifest frames it as an ads tool, but the implementation can be repurposed to reach unintended Partner APIs through the same gateway.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements phone-based login, API-key issuance, package listing, order creation, and payment QR handling, which are unrelated to the declared Temu US Ads forwarding scope. In a skill context, hidden onboarding and billing flows expand the trust boundary, collect sensitive user data, and can steer users into account and payment actions they did not request.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can fetch or generate LinkFox API tokens for a user's group after SMS login. That capability is highly sensitive and not justified by a Temu Ads integration skill, because it can mint reusable credentials that broaden access beyond the immediate user task.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The package purchase and payment-order logic is outside the advertised ads API purpose and introduces monetization behavior into a skill that users would not expect to handle billing. This can manipulate users into purchasing platform services and increases the damage from misuse by combining credential handling with commerce flows.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The QR rendering code writes payment-related artifacts to local session directories, which is not aligned with the stated Temu Ads purpose and creates local persistence of sensitive transaction data. In shared or multi-tenant environments, these files may be discoverable by other processes or users, exposing payment links or transaction details.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script is a generic Temu API proxy: it accepts an arbitrary API "type" and forwards caller-supplied parameters and access tokens to a shared proxy endpoint. That exceeds the advertised US Ads-only scope and can expose unrelated Temu capabilities if the surrounding skill routing or policy layer assumes this tool is constrained to advertising operations.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module documentation explicitly describes forwarding Temu platform API requests generally, which contradicts the skill description that positions this as a US Ads-specific integration. This mismatch increases the chance that reviewers, orchestrators, or users will trust the skill as narrowly scoped when it is actually capable of broader actions, weakening least-privilege assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script is implemented as a generic US proxy that forwards an arbitrary caller-supplied API type to the shared `us_proxy_call` helper, while the skill metadata claims the skill is limited to Temu US Ads APIs. The docstring further advertises `tokenPurpose: "product-inventory"`, which signals cross-domain use and increases the likelihood that callers can reach non-Ads Partner endpoints through this skill, bypassing intended capability scoping and least-privilege boundaries.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The inline example contradicts the advertised ads-only scope by showing product-inventory usage, which can mislead integrators and downstream agents into invoking this proxy for unauthorized API families. In a generic proxy design, such contradictory guidance is dangerous because it normalizes out-of-scope access and may facilitate accidental or intentional abuse of broader Temu US capabilities than the skill is supposed to expose.

Vague Triggers

Medium

• Confidence: 72% confidence
• Finding: The trigger terms are broad and include common words related to ads, budgets, reports, and inventory, which can cause unintended invocation. Because the skill can access tokens, network endpoints, and write local files, accidental triggering increases the risk of unnecessary data handling or external API calls without clear user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs the tool to always write full API responses to local files, but does not prominently warn users that those responses may contain access tokens, account identifiers, business metrics, or other sensitive data. Persisting full responses by default creates avoidable retention and disclosure risk, especially in shared workspaces or repositories.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly recommends storing Temu access tokens locally in a JSON file and provides copy-paste commands for doing so, but it does not warn that these are sensitive bearer credentials or discuss filesystem permission, encryption, redaction, backup exposure, or multi-user host risks. If users follow this guidance on shared or poorly secured systems, the token can be stolen from disk and reused to access Temu business APIs through the skill workflow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly supports destructive ad operations such as delete, pause, and budget/ROAS changes, but it does not require confirmation steps, warn about irreversible business impact, or advise operators to verify target goods before execution. In an ads-management skill, this omission increases the chance of accidental or unauthorized high-impact campaign changes that can stop spend, disrupt traffic, or permanently remove ad configurations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs users to manually copy an access token from the Temu seller backend and optionally save it to a local store, but does not warn that the token is a bearer secret that grants API access. In an ads-management skill context, such a token could expose campaign configuration, reports, budget controls, and other merchant operations if copied insecurely, logged, or stored without protection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The onboarding flow asks the user to provide a phone number for script-based registration but does not include any privacy notice, consent language, retention limits, or handling restrictions for personal data. In a support/onboarding context, collecting a phone number without clear disclosure increases the risk of unnecessary exposure of personally identifiable information and mishandling by the agent or surrounding systems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to create plan orders and guide users through external payment methods, but it does not clearly warn that these actions may generate chargeable orders or send the user to third-party payment processing. That omission can lead to accidental purchases, social-engineering-like confusion, or users being steered into payment flows without informed consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists Temu access tokens to a local JSON file in plaintext without setting restrictive file permissions or warning the user that credentials are being stored on disk. On multi-user systems, shared environments, backups, or compromised hosts, these tokens could be recovered and used to access or manipulate the linked advertising account.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file-download helper forwards both a sensitive access token and a user-supplied URL to a backend download endpoint without validating the destination. This creates SSRF-style and confused-deputy risk: an attacker may induce the gateway to fetch arbitrary internal or untrusted resources while authenticating the request in the context of the user's store/account.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.