Temu欧洲站-取消订单

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:51 PM UTC
• Version: 1.0.6

Overview

This skill is not clearly malicious, but it exposes broader commerce, credential, payment, download, and local persistence capabilities than a user may expect from an EU order-cancellation skill.

Install only if you are comfortable giving this skill LinkFox and Temu API access for live EU cancellation workflows. Use a dedicated low-privilege LinkFox key where possible, avoid pasting long-lived Temu tokens into shell history, review any cancellation request before running it, and periodically delete saved response files and token-store entries you no longer need. Treat onboarding and payment commands as separate account-management actions, not ordinary cancellation steps.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents capabilities to read environment variables, write files, and make network requests, yet it does not declare permissions. This weakens reviewability and consent boundaries: a user or platform may believe the skill is narrowly scoped while it can access secrets, persist data locally, and send data off-host. In a payment/order-management context, those undeclared capabilities materially increase the risk of secret exposure and unauthorized external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a narrow EU cancel-order wrapper, but the described behavior includes a generic proxy, file download, token storage/listing, token validation, and onboarding/payment flows. That mismatch is dangerous because it hides a much broader operational and data-access surface than users expect, enabling actions far beyond order cancellation, including account onboarding and payment-related operations. Security reviewers and users could under-trust the risk because the label appears narrow while the effective capability is expansive.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation inconsistently scopes the skill as seller-initiated cancellation while also advertising buyer aftersales cancellation endpoints in the same skill. This can cause an agent or operator to invoke buyer-side cancellation actions when they intended only seller-side functions, increasing the risk of unauthorized order state changes or misuse of the wrong API flow.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The shared helper persistently saves full API responses, session metadata, and file indexes to local disk even though this skill is described as an order-cancellation API forwarder. Those responses may contain access tokens, order data, buyer/seller identifiers, or other sensitive business information, creating unnecessary data retention and expanding exposure if the host is shared or compromised.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The code searches multiple writable directories and creates a persistent session root plus an index file unrelated to the core cancel-order function. While not inherently malicious, this behavior broadens the footprint of collected data and makes it harder for operators to know where sensitive API artifacts are being stored.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements an onboarding and monetization CLI for LinkFox accounts: SMS login, API key acquisition, plan listing, order creation, and payment QR generation. Those capabilities are unrelated to a Temu EU order-cancellation skill and indicate significant scope divergence, increasing the chance the skill is collecting credentials and steering users into unrelated account/payment flows.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can retrieve or generate new API tokens for the user via /group/getApiToken and /group/generateApiToken. In the context of a Temu cancellation skill, token minting is an unjustified high-privilege capability that could let the skill obtain durable credentials beyond the user's immediate task.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code supports package discovery, paid order creation, and QR-code payment rendering for LinkFox plans. Billing and subscription purchase are unrelated to canceling Temu EU orders, so this functionality creates unjustified financial-risk surface and could induce unauthorized purchases under the guise of the advertised skill.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script persists a sensitive Temu access token to local storage for later reuse, but the cancel-order skill description does not justify long-term local credential storage. Persisting tokens broadens exposure: if the local store is readable by other users, processes, logs, backups, or later-compromised components, the token can be reused to access Temu APIs beyond the immediate operation.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script implements a generic signed file download capability through /temu/fileDownload, but the declared skill scope is specifically for Temu EU order-cancellation workflows. That mismatch materially expands the skill's effective privileges and functionality beyond what users and reviewers would expect, creating a confused-deputy risk where the skill can be used to retrieve arbitrary signed Temu resources unrelated to cancellation operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill supports live order-cancellation operations, which are destructive and potentially irreversible, but the documentation lacks an explicit warning or confirmation requirement. In this business context, that increases the chance of accidental cancellation of customer orders or seller inventory actions, causing financial loss, customer harm, and operational disputes. The danger is elevated because the skill is designed for production commerce workflows rather than a sandbox or educational context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document recommends storing a live Temu access token on disk in a predictable local path and shows example commands containing raw secrets, but it does not clearly warn that the token is sensitive, long-lived credential material. If the local machine is shared, compromised, backed up insecurely, or the file permissions are weak, the token could be recovered and used to access Temu business APIs as the merchant.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs users to copy a Temu access token from the seller backend and optionally save it locally, but it does not warn that the token is a sensitive credential that can grant API access to orders, shipping, or store operations. In a skill specifically designed to proxy Temu API calls across multiple sites and management types, this omission materially increases the risk of credential leakage, insecure storage, and misuse of downstream account privileges.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs operators to collect a user's phone number and use it to drive registration/login flows, but it provides no privacy notice, consent guidance, retention limits, or handling restrictions for that personal data. In an agent setting, this can normalize unsafe collection of sensitive identifiers and verification codes, increasing the risk of unauthorized account creation, account takeover, or mishandling of personal data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill tells operators to run shell commands that permanently modify user shell startup files or environment settings to install an API key, but it does not clearly warn that these are persistent system changes. This can lead to unintended credential exposure, configuration corruption, or execution in the wrong environment, especially if users blindly copy commands into shared or production systems.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The guide instructs users to copy an access token and save it for later API use, but provides no warning about secret handling, least-privilege, storage protections, or exposure risks. In an agent skill context, normalization of copying and storing bearer tokens without safety guidance increases the chance of credential leakage, accidental logging, or insecure persistence that could enable unauthorized API access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: API responses are written to disk automatically with no clear disclosure or opt-in at the point of use. Because these responses may include sensitive operational or account data, silent persistence can violate user expectations and increase the chance of unintended local disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file download helper accepts a user-controlled URL and sends it together with an access token to a backend download endpoint, creating an SSRF-style primitive and risking token disclosure to unintended resources or internal services. In the context of an agent skill that may process user-supplied parameters, this is more dangerous because an attacker could coerce the system into fetching arbitrary URLs through trusted infrastructure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script emits the access token in plaintext to stdout, which can expose credentials to logs, calling processes, shell history workflows, or downstream tooling that captures command output. In a skill ostensibly focused on order cancellation, bundling a generic token-dumping utility increases the risk of credential reuse outside the intended business flow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script explicitly accepts an access token via command-line JSON and saves it locally, but provides no explicit warning that the credential will be persisted. This is dangerous because users may unknowingly leave reusable secrets in local storage, and command-line supplied secrets can also be exposed through shell history, process listings, terminal logs, or automation traces before they are even stored.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs saving complete API responses to local files and sometimes printing full JSON to stdout. Those responses may contain access tokens, order identifiers, customer/order data, or other sensitive fields, so persisting and echoing them broadly increases the risk of credential leakage, accidental log disclosure, and cross-task data exposure on shared systems. Because the skill also uses env-based credentials and commerce APIs, this creates a realistic path to both privacy and account-security incidents.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The helper writes full serialized API responses and session metadata to persistent local files without minimization or redaction. If the API response contains tokens, store information, cancellation details, or customer/order metadata, those secrets remain exposed on disk and may be accessible to other local users, backups, or later compromise.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/temu_proxy.py:7