Temu全球站-取消订单

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:51 PM UTC
• Version: 1.0.6

Overview

The skill mainly supports Temu Global order cancellation, but it also bundles broad proxy, credential, onboarding, billing, file-download, and persistence capabilities that exceed that narrow purpose.

Review this skill carefully before installing. It should only be used in an environment where you are comfortable granting LinkFox and Temu seller credentials, allowing network calls to LinkFox/Temu gateways, storing order responses and access tokens on disk, and exposing broader Temu API/file-download and billing/onboarding workflows. Prefer a narrowed version limited to the six cancellation APIs with masked credentials, explicit confirmations, no raw token export, and opt-in/redacted persistence.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The POST destination is derived from helper functions that read environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then used to send SMS-login data, access tokens, refresh tokens, and other account metadata. If an attacker can influence the runtime environment, they can redirect these authenticated requests to an attacker-controlled host and exfiltrate credentials or verification data. The danger is increased because this skill is unrelated to Temu order cancellation and performs high-value account onboarding flows.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway request target is built from environment-controlled base URLs and then passed to urllib.request.urlopen with the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables could redirect order/account traffic and capture API keys or manipulate downstream responses. In the context of a Temu cancel-order skill, this unexpected generic gateway and account access path broadens the attack surface substantially.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit permissions while documenting use of environment variables, network calls to external gateways, and automatic local file writes. This creates a transparency and policy-enforcement gap: users and host systems may not realize the skill can access credentials and persist API responses containing potentially sensitive order or token data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is a limited Temu Global cancellation wrapper, but the skill references materially broader capabilities including onboarding/login flows, API key generation, payment/package operations, generic proxying for arbitrary API types, file download, and token storage/retrieval. This scope expansion increases attack surface and can enable unintended access to unrelated account, payment, or credential-management functions beyond what a user would reasonably authorize.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The helper unconditionally serializes and writes full API responses to local disk, which can include order data, identifiers, tokens, or other sensitive business/customer information beyond the skill's narrow cancellation purpose. In a shared helper used by multiple entrypoints, this creates unnecessary data retention and expands exposure if local files are accessed by other users, processes, or later sessions.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code builds a reusable session directory structure and appends to a cross-session index.jsonl archive, creating a durable catalog of skill activity unrelated to performing a one-time cancellation request. This broadens the blast radius of any sensitive response data by making discovery and correlation across sessions easier for anyone with filesystem access.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This helper script retrieves a stored Temu access token and emits the raw credential in JSON to stdout. In the context of a cancel-order skill, exposing generic credential-retrieval functionality broadens the skill’s capability beyond its declared purpose and makes token exfiltration easy via logs, tool output capture, or misuse by other components.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The file’s primary behavior is generic access to the token store rather than implementing order-cancellation logic described by the manifest. That capability mismatch is dangerous because it creates an unexpected credential-access primitive inside a business-action skill, increasing the chance of abuse and making security review and permission boundaries less clear.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This script enumerates locally saved Temu access tokens and can disclose them, which is sensitive credential material unrelated to the declared cancel-order skill behavior. Even though masking is enabled by default, the script explicitly supports disabling masking, making credential exposure easy for anyone with local execution access.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The package contains token-store inspection functionality that falls outside the stated purpose of forwarding Temu cancel-order APIs. Hidden or undocumented credential-inspection features increase the attack surface and create opportunities for misuse, especially in an agent skill where included utilities may be invoked unexpectedly or repurposed by an attacker.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, login, package browsing, purchasing, and payment QR generation, none of which are necessary for a Temu Global cancel-order skill. Such capability mismatch is dangerous because it can trick users or hosts into granting credentials and performing billing actions under the guise of an unrelated commerce-cancellation integration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can list purchasable plans, create orders, and render payment QR codes, introducing direct billing functionality into a skill whose declared purpose is canceling Temu orders. This creates a risk of unauthorized charges, deceptive upsells, or abuse of the host environment for unrelated monetization flows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file sends SMS verification codes, logs users into LinkFox, and generates or retrieves API keys, which is unrelated to canceling Temu orders and collects highly sensitive authentication material. This can be used to harvest user identities, obtain reusable API credentials, and pivot into broader account access beyond the stated skill scope.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The script adds a credential-handling capability that is outside the stated purpose of a Temu Global order-cancellation skill, broadening the skill's effective privileges and attack surface. A local token-saving utility can enable persistence and reuse of marketplace access tokens for unrelated actions, which is especially dangerous in an agent-integrated environment where users may not expect credential storage.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The usage documentation explicitly supports broader sites and token purposes such as cn and product-inventory, which exceeds the declared global cancellation scope. This mismatch can mislead reviewers and users about what the skill is actually capable of, enabling inappropriate token collection and cross-scope reuse.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code persists an access token locally via save_token without showing any justification tied to order cancellation, creating a reusable credential cache. Stored tokens are high-value secrets; if the local store is accessed by other processes, users, logs, backups, or later tooling, an attacker could perform unauthorized API actions beyond the immediate session.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements signed file download functionality, but the declared skill is for Temu Global order cancellation. This capability mismatch is dangerous because it introduces an unrelated network-accessing primitive that could be used to retrieve sensitive signed resources or expand the skill's effective permissions beyond user expectations and the documented scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A signed file download endpoint accepts a user-supplied URL and access token in a skill that is supposed to cancel orders. Even if the backend ultimately validates the signed URL, exposing this operation in the wrong skill creates unjustified access to downloadable resources, increases the attack surface, and can enable unauthorized data retrieval through social engineering or accidental invocation.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script exposes a file-download operation in a skill whose declared purpose is canceling Temu Global orders. That scope mismatch is dangerous because it expands the agent’s effective privileges beyond user expectations and routing intent, enabling arbitrary file retrieval through the LinkFox/Temu gateway if invoked with a user-supplied URL or token. In this context, the mismatch makes the issue more dangerous because users and policy layers may permit the cancel-order skill while not expecting any data access or exfiltration capability.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The docstring says "US site file download" while the code defaults to the global site, creating misleading documentation around which environment the script affects. This is dangerous because operators, reviewers, and automated tooling may misunderstand the target scope and apply the wrong approvals, secrets, or monitoring, increasing the chance of unauthorized or unintended access. In a skill already exhibiting scope drift, contradictory labeling raises suspicion and makes misrouting harder to detect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script implements a generic Temu API proxy by accepting an arbitrary `type` value and forwarding arbitrary `params`, which materially exceeds the skill’s declared cancel-order-only scope. In an agent setting, this can let callers invoke unrelated Temu APIs through a skill that users and policy layers may trust as narrowly scoped, creating a privilege/scope-bypass path and increasing the chance of unauthorized actions or data access.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module docstring explicitly describes the tool as a general Temu API proxy and even gives an example for a non-cancel API (`bg.goods.category.mapping`), contradicting the skill’s stated business purpose. This mismatch is dangerous because operators, reviewers, and automated routing may assume the skill is constrained to cancellations when it is actually designed and documented for broader API access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs that complete API responses are always written to disk but does not clearly warn that those responses may include sensitive order details, identifiers, or token-related data. Users and downstream tools may therefore unknowingly retain sensitive data in project directories where it can be exposed through backups, version control, shared workspaces, or later prompt ingestion.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly recommends storing sensitive Temu access tokens on disk in a predictable local path and provides helper scripts to save and retrieve them, but it does not clearly warn that these tokens are credentials or describe the risks of local compromise, backup leakage, shared-user access, or weak file permissions. Because these tokens authorize Temu business API actions, theft of the stored token could enable unauthorized order, inventory, or seller-account operations through the proxy workflow.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation exposes an approval action for canceling an order and describes it as a normal workflow step without an explicit warning that it is state-changing and may be irreversible. In an agent skill context, that increases the chance an automation or operator will invoke it based on ambiguous user input, causing unintended order cancellations, financial loss, or customer-impacting fulfillment errors.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.