Security audit

Temu欧洲站-取消订单

Security checks for vulnerabilities and agentic risk

Overview

This skill can support Temu EU order cancellation, but it also exposes broader proxy, payment, and credential-storage behavior with weak scoping and unsafe data handling.

Install only if you trust LinkFox and need Temu cancellation through its gateway. Before use, avoid setting endpoint override environment variables, do not invoke arbitrary proxy types or non-EU sites, keep LinkFox and Temu tokens out of shared workspaces and logs, restrict permissions on any `linkfox` output and token-store files, and use the payment/onboarding flow only when you intentionally want to buy LinkFox credits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/_temu_common.py:15
Finding: Credential Exfiltration Through Unrestricted API Endpoint Overrides
Content: View full analysis
dict: linkfox_token = get_linkfox_token(linkfox_params) data = json.dumps(body, ensure_ascii=False).encode("utf-8") req = Request( url, data=data, headers=build_gateway_headers(linkfox_token), method="POST", ) try: with urlopen(req, timeout=timeout) as response: return json.loads(response.read().decode("utf-8")) ``` ```python body = { "site": site, "managementType": management_type, "accessToken": resolve_access_token(params), "type": api_type, } ``` Onboarding uses independently configurable destinations: ```python def _agent_base() -> str: return _env_base( "LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY", ) def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base( "LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com", ) ``` ```python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body ...[truncated 2696 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_temu_token_store.py:29
Finding: Temu Access Tokens Stored in Plaintext Without Restrictive Permissions
Content: View full analysis
str: return os.environ.get("TEMU_TOKEN_STORE_PATH", DEFAULT_STORE_PATH) ``` ```python def _save_store(data: dict) -> None: path = store_path() parent = os.path.dirname(path) if parent: os.makedirs(parent, exist_ok=True) with open(path, "w", encoding="utf-8") as f: json.dump(data, f, indent=2, ensure_ascii=False) f.write("\n") ``` ```python entry = { "site": site, "managementType": management_type, "tokenPurpose": token_purpose, "accessToken": access_token, "updatedAt": _utc_now(), } ``` ### Technical Analysis The token store writes reusable Temu access tokens directly into a JSON file. Neither the parent directory nor the credential file receives an explicit restrictive mode. The effective permissions are inherited from the process umask. With a common umask of `022`, a newly created regular file can be mode `0644`, allowing other local users to read it. Existing files with permissive permissions are also opened and rewritten without correcting their mode. The configurable `TEMU_TOKEN_STORE_PATH` increases exposure because the path can point to a shared workspace, mounted directory, synchronized folder, or other location with weaker access controls. The implementation does not verify ownership, reject symbolic links, use atomic secure creation, or prevent following a pre-existing symlink. ### Attack Path 1. A user saves a Temu token with `save_temu_access_token.py`. 2. `_save_store` creates or rewrites the JSON file using process-default permissions. 3. Another local user, a process running under a different account with shared-directory access, or a workspace collector read ...[truncated 921 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_temu_common.py:178
Finding: Complete API Responses Persisted to Potentially Shared Locations Without Access Controls
Content: View full analysis
str: cached = _LF_SESSION_CACHE.get("_root") if cached: return cached candidates = [] acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip() if acpx: acpx = acpx.split(os.pathsep)[0].strip() if acpx: candidates.append(os.path.join(acpx, "linkfox")) candidates.append(os.path.join(os.getcwd(), "linkfox")) candidates.append(os.path.join(os.path.expanduser("~"), "linkfox")) candidates.append( os.path.join(_lf_tempfile.gettempdir(), "linkfox") ) for root in candidates: try: os.makedirs(root, exist_ok=True) probe = os.path.join(root, ".write_probe") with open(probe, "w", encoding="utf-8") as f: f.write("") os.remove(probe) except OSError: continue root = os.path.abspath(root) _LF_SESSION_CACHE["_root"] = root return root ``` ```python def emit_result(result, slug=SLUG, inline=False): serialized = json.dumps(result, ensure_ascii=False, indent=2) ts = _lf_time.time() date_str = _lf_time.strftime( "%Y-%m-%d", _lf_time.localtime(ts) ) sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join( data_dir, f"{slug}-{int(ts * 1_000_000)}.json", ) try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) print( f"Saved full response: {out} " f"({len(serialized)} bytes)" ...[truncated 2174 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_temu_common.py:210
Finding: Path Traversal Through Unvalidated Session Identifier
Content: View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime( "%H%M%S", _lf_time.localtime(ts) ) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` ```python sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join( data_dir, f"{slug}-{int(ts * 1_000_000)}.json", ) ``` Onboarding uses the same unsafe construction: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) path = os.path.join( _linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid, ) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is treated as a trusted path component without validation. It can contain: - Parent-directory traversal sequences such as `../` - Absolute Unix paths - Absolute Windows paths - Platform-specific path separators - Excessively long or otherwise malformed values With `os.path.join`, an absolute later component can discard all preceding components. Relative traversal sequences are normalized by filesystem operations and can escape the intended dated session directory. The ca ...[truncated 1632 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (61)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The code builds request destinations from environment-controlled base URLs and then sends login tokens, API-key generation requests, and other sensitive data to those endpoints. If an attacker can influence environment variables, they can redirect requests to a hostile server and exfiltrate credentials or perform SSRF-style access to unintended hosts; this is especially dangerous because the file handles access tokens, refresh tokens, phone numbers, and generated API keys.
Content: Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.
python
except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The gateway helper sends authenticated requests with the LinkFox API key to a URL derived from environment variables, so a poisoned environment can redirect traffic and leak the bearer credential. Because this helper is used for account, package, and order operations, exploitation can expose secrets and enable unauthorized actions against attacker-controlled or internal endpoints.
Content: Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.
python
headers["Content-Type"] = "application/json" req = Request(url, method=method, data=body_bytes, headers=headers) try: with urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: status = e.code

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill advertises a narrow EU cancel-order function but explicitly exposes a generic proxy script for arbitrary type values, which materially broadens what operations an agent could invoke. In an agent environment, a generic API forwarder behind cancellation-themed branding can bypass user expectations and enable unintended actions against other Temu/LinkFox APIs.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.
md
证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`） - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效： - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"` - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc` - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc` - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可 **billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。 - `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选 - 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`） - `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This skill is presented as a Temu EU order-cancellation capability, but the code is actually an onboarding and monetization CLI for LinkFox accounts, including SMS login, API-key acquisition, package browsing, and order/payment flows. That mismatch is a strong indicator of deceptive scope and creates a credential-harvesting and account-manipulation risk unrelated to the declared business function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Embedding billing, paid order creation, and QR-code payment rendering inside a cancel-order skill is unjustified by the stated functionality and can be used to induce users or agents to purchase unrelated services. In this context, the payment flow increases harm because the skill already has login and token-handling logic, making it suitable for deceptive upsell or abuse of user trust.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The login flow emits a freshly obtained API key to stdout JSON, which can be captured by logs, calling agents, shell history wrappers, transcripts, or other downstream tooling. In an agent-skill context this is particularly dangerous because stdout is often persisted or exposed across components, turning a valid credential into an easily leaked secret.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is advertised as a cancel-order skill, but the code acts as a generic Temu EU API proxy by taking arbitrary "type" input and passing it into eu_proxy_call. In an agent environment, this is dangerous because higher-level trust and permission decisions may rely on the advertised narrow scope, enabling unauthorized actions or data access through a deceptively broad interface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Arbitrary API-type forwarding gives callers a capability broader than justified for a cancellation-specific skill, effectively turning this into a confused-deputy proxy. Because the skill context suggests users or orchestrators will invoke it for benign cancel-order tasks, the hidden breadth makes misuse more likely and increases the chance of unintended order, aftersales, or account-affecting operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements signed file-download behavior even though the skill is described as a Temu EU cancel-order skill. Capability drift like this is dangerous because it can expose an unrelated network action that operators and callers would not expect, creating a hidden data-access or exfiltration path through the skill surface. The risk is increased by the fact that it forwards a caller-supplied URL together with an access token to an external API helper, so a mis-scoped or mislabeled skill could be abused under the guise of order cancellation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script is a generic Temu proxy that forwards an arbitrary API 'type' and attacker-controlled 'params' to the backend, while the skill manifest describes a narrowly scoped EU cancel-order capability. This creates a privilege/scope expansion risk: a user or downstream agent can invoke unrelated Temu APIs through this skill, bypassing intended least-privilege boundaries and enabling unauthorized actions or data access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Although the skill is presented as EU-only, the code accepts any site value permitted by validate_site() and forwards it unchanged in the request body. If validate_site allows non-EU regions such as 'cn' or 'us' as suggested by the usage example, callers can use this skill against other Temu regions, violating tenant/region boundaries and potentially exposing or modifying data outside the intended EU scope.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents capabilities that read environment variables, write files, and make network requests, but it does not declare any tool scope restrictions such as permissions or allowed-tools. In an agent setting, undeclared capability scope weakens least-privilege boundaries and can let the skill access more than users or reviewers expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states that full API responses are always written to the project directory, and those responses may contain access tokens, order identifiers, customer/order metadata, or other sensitive business data. Persisting such data by default without strong warning, minimization, or redaction increases the chance of credential leakage, accidental commits, cross-task exposure, and local data retention beyond user intent.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/temu_proxy.py:7