Temu全球站-取消订单

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.0.6

Overview

The skill provides Temu cancellation functions, but it also includes broad proxy, credential storage, payment, and endpoint-override behavior that needs review before installation.

Review this before installing if you will use real seller accounts. Use only trusted LinkFox endpoints, avoid setting gateway override environment variables, prefer short-lived and least-privileged Temu tokens, avoid unmasked token output, and be aware that billing commands can create payment orders and that full API responses are saved locally.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_temu_token_store.py:8

Finding

Temu seller access tokens are stored in plaintext without enforced access permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/_temu_token_store.py:8, 29-35, 63-68
Vulnerability Type: Plaintext credential storage with unsafe default permissions
Risk Level: High

Vulnerable Code

python

DEFAULT_STORE_PATH = os.path.expanduser("~/.linkfox/temu-access-tokens.json")

python

def _save_store(data: dict) -> None:
    path = store_path()
    parent = os.path.dirname(path)
    if parent:
        os.makedirs(parent, exist_ok=True)
    with open(path, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
        f.write("\n")

python

entry = {
    "site": site,
    "managementType": management_type,
    "tokenPurpose": token_purpose,
    "accessToken": access_token,
    "updatedAt": _utc_now(),
}

Technical Analysis

Temu seller access tokens are written directly into a plaintext JSON file. The implementation does not encrypt the credentials, use an operating-system credential manager, or explicitly enforce owner-only directory and file permissions.

File accessibility therefore depends on the process umask and pre-existing filesystem state. The write operation also does not reject symbolic links or use an atomic, securely created temporary file. A permissive umask, exposed home-directory backup, compromised local process, or maliciously prepared token-store path could disclose the credential.

These tokens are particularly sensitive because the declared Skill functionality includes seller order-cancellation operations. Storing them is optional convenience behavior rather than a strict requirement for individual API calls, because the Skill also accepts an access token directly.

Attack Path

1. A user invokes save_temu_access_token.py and supplies a valid Temu seller token.
2. _save_store writes that token in plaintext to ~/.linkfox/temu-access-tokens.json, or to the path selected through `TEMU_TOKEN_ ...[truncated 1078 chars]

Remediation

View remediation

Remediation Suggestions

1. Store access tokens in an operating-system credential manager such as macOS Keychain, Windows Credential Manager, or a Linux secret service.
2. If file storage must remain available:
   • Create ~/.linkfox with mode 0700.
   • Create the token file with mode 0600.
   • Explicitly correct permissions on existing files before use.
   • Reject symbolic links and non-regular files.
   • Write through a securely created temporary file and atomically replace the destination.
3. Validate TEMU_TOKEN_STORE_PATH and clearly warn users when it points to a shared or temporary directory.
4. Avoid exposing unmasked tokens through helper commands unless the user explicitly requests and confirms it.
5. Document token rotation and revocation procedures.
6. Prefer short-lived, narrowly scoped tokens where supported.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_temu_common.py:14

Finding

Environment-controlled gateway can redirect LinkFox and Temu credentials to an arbitrary server

Content

View full analysis

Vulnerability Details

File Location: scripts/_temu_common.py:14-20, 101-111; scripts/_temu_global_common.py:52-61
Vulnerability Type: Unvalidated credential-bearing network destination
Risk Level: High

Vulnerable Code

python

BASE_URL = (
    os.environ.get("LINKFOX_TOOL_GATEWAY")
    or os.environ.get("TEMU_API_BASE_URL")
    or os.environ.get("STORE_API_BASE_URL", "https://tool-gateway.linkfox.com")
)
BASE_URL = BASE_URL.rstrip("/")
PROXY_URL = f"{BASE_URL}/temu/proxy"
FILE_DOWNLOAD_URL = f"{BASE_URL}/temu/fileDownload"

python

def call_temu_api(
    url: str,
    body: dict,
    timeout: int = 150,
    linkfox_params=None,
) -> dict:
    """Call the Temu gateway API; a LinkFox user token is required."""
    linkfox_token = get_linkfox_token(linkfox_params)
    data = json.dumps(body, ensure_ascii=False).encode("utf-8")
    req = Request(
        url,
        data=data,
        headers=build_gateway_headers(linkfox_token),
        method="POST",
    )
    try:
        with urlopen(req, timeout=timeout) as response:
            return json.loads(response.read().decode("utf-8"))

python

body = {
    "site": site,
    "managementType": management_type,
    "accessToken": resolve_access_token(params),
    "type": api_type,
}
biz = business if business is not None else extract_business_params(params)
if biz:
    body["params"] = biz
return body

The authentication headers constructed for this request contain the LinkFox credential:

python

return {
    "Authorization": linkfox_token,
    "Token": linkfox_token,
    "Content-Type": "application/json",
    "User-Agent": "LinkFox-Skill/1.0",
}

Technical Analysis

The default destination, https://tool-gateway.linkfox.com, matches the gateway disclosed in SKILL.md, and forwarding the Temu token to that gateway is necessary for the declared proxy ar ...[truncated 2064 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin production requests to https://tool-gateway.linkfox.com.
2. If endpoint overrides are required for testing:
   • Require an explicit development-mode flag.
   • Enforce the https scheme.
   • Maintain a strict hostname allowlist.
   • Reject embedded credentials, unexpected ports, IP-literal hosts, and malformed URLs.
   • Display a clear warning and require confirmation before sending credentials to a non-production endpoint.
3. Never allow production credentials to be used with arbitrary development endpoints.
4. Separate test and production credentials and configurations.
5. Consider certificate or public-key pinning if the operational environment supports safe pin management.
6. Minimize duplicate credential exposure by using only the authentication header required by the gateway.
7. Add automated tests confirming that HTTP and unapproved hosts are rejected.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_temu_common.py:176

Finding

Complete API responses can be written to shared or attacker-selected filesystem paths

Content

View full analysis

Vulnerability Details

File Location: scripts/_temu_common.py:176-204, 211-218, 309-329
Vulnerability Type: Unsafe sensitive-response persistence and path handling
Risk Level: Medium

Vulnerable Code

python

def _lf_root() -> str:
    cached = _LF_SESSION_CACHE.get("_root")
    if cached:
        return cached
    candidates = []
    acpx = (os.environ.get("ACPX_WORKSPACES") or "").strip()
    if acpx:
        acpx = acpx.split(os.pathsep)[0].strip()
        if acpx:
            candidates.append(os.path.join(acpx, "linkfox"))
    candidates.append(os.path.join(os.getcwd(), "linkfox"))
    candidates.append(os.path.join(os.path.expanduser("~"), "linkfox"))
    candidates.append(os.path.join(_lf_tempfile.gettempdir(), "linkfox"))
    for root in candidates:
        try:
            os.makedirs(root, exist_ok=True)
            probe = os.path.join(root, ".write_probe")
            with open(probe, "w", encoding="utf-8") as f:
                f.write("")
            os.remove(probe)
        except OSError:
            continue
        root = os.path.abspath(root)
        _LF_SESSION_CACHE["_root"] = root
        return root
    fallback = os.path.abspath(candidates[-1])
    _LF_SESSION_CACHE["_root"] = fallback
    return fallback

python

def _lf_session_id(ts: float) -> str:
    env = os.environ.get("SESSION_ID")
    if env:
        return env.strip()
    if "_auto" not in _LF_SESSION_CACHE:
        _LF_SESSION_CACHE["_auto"] = (
            _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3)
        )
    return _LF_SESSION_CACHE["_auto"]

python

def emit_result(result, slug=SLUG, inline=False):
    """Persist the complete response and print either the response or a summary."""
    serialized = json.dumps(result, ensure_ascii=False, indent=2)
    ts = _lf_time.time()
    date_str = _lf_time.str
...[truncated 3458 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the system temporary-directory fallback and fail closed when the approved output directory is unavailable.
2. Validate SESSION_ID with a strict allowlist such as ^[A-Za-z0-9._-]{1,64}$.
3. Reject absolute paths, path separators, . components, and .. components.
4. Resolve the final path and verify with os.path.commonpath that it remains beneath the approved storage root.
5. Create session directories with mode 0700 and response files with mode 0600.
6. Reject symbolic links and unexpected pre-existing filesystem objects.
7. Make full-response persistence opt-in, or allow users to disable it for sensitive operations.
8. Redact tokens, signed URLs, personal data, and other sensitive fields before persistence where full fidelity is unnecessary.
9. Define and enforce a retention policy, including secure deletion or expiration of old response files.
10. Update the implementation and documentation so their temporary-storage behavior is consistent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (48)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material such as access tokens, refresh tokens, API keys, phone numbers, and SMS codes to those endpoints via requests.post. If an attacker can influence environment variables in the runtime, they can redirect these secrets to attacker-controlled infrastructure, causing credential exfiltration and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway helper uses environment-derived base URLs with urllib.request.urlopen while attaching the LinkFox API key in the Authorization header. An attacker who can alter those environment variables can cause the CLI to send authenticated requests to a malicious server, exposing API credentials and enabling misuse of the linked account.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill mainly provides token/access guidance rather than invoking cancellation endpoints, it is still a material description-behavior mismatch because agents and users may rely on it for operational actions it does not safely constrain. Guidance that steers users through auth flows can also expose sensitive inputs or normalize broader secret handling than expected for this skill.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code directly serializes and prints the retrieved access token to stdout without any masking or disclosure controls. In an agent skill context, stdout is especially risky because tool outputs are often ingested into logs, transcripts, telemetry, or surfaced back to users, turning a local secret into a broadly exposed credential that can be reused against Temu APIs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This utility enumerates locally saved Temu access tokens and can optionally print them unmasked via a user-controlled parameter. Exposing authentication tokens is highly sensitive because anyone with access to the script output may reuse those credentials to access Temu-linked APIs, and this capability is unrelated to the stated order-cancellation function of the skill, which increases suspicion and risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements a standalone onboarding, login, API-key issuance, package-purchase, and payment workflow that is unrelated to a Temu Global cancel-order skill. Such scope divergence is dangerous because it introduces hidden credential collection and monetization functionality into a skill whose declared purpose would not cause users or reviewers to expect those actions, increasing the chance of deceptive data capture and unauthorized billing flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code creates purchase orders and renders payment QR codes, capabilities that are unrelated to order cancellation and can directly induce users to make payments. In this skill context, that mismatch is highly suspicious because it enables unexpected commerce operations and possible social-engineering or fraudulent billing under the cover of a Temu cancellation integration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code can retrieve or generate LinkFox API tokens for a user group after SMS-based login, which grants durable authenticated access beyond the immediate session. In the context of a cancellation-only Temu skill, this is especially dangerous because it creates a covert account bootstrap and token-minting path that could be used for persistent unauthorized access or downstream abuse of the user's LinkFox environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script adds a persistent credential-handling capability to a skill whose declared purpose is cancel-order operations. Saving access tokens locally creates a new secret-retention surface that is not justified by the exposed skill behavior, increasing the chance of credential leakage, reuse by unrelated functions, or abuse of marketplace APIs beyond order cancellation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script explicitly stores access tokens in a local store for later reuse, which is a sensitive credential persistence mechanism. In the context of a cancel-order skill, this is especially risky because it enables durable possession of marketplace credentials that could be exfiltrated, reused across sessions, or leveraged for unauthorized API activity if the host or adjacent tooling is compromised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements a generic Temu signed file download capability, which is unrelated to the declared skill purpose of canceling orders. This kind of capability mismatch is dangerous because it expands the skill's effective permissions and attack surface beyond what operators and users expect, potentially enabling unauthorized retrieval of signed resources or data exfiltration through the LinkFox gateway. The mismatch is especially concerning in a narrowly scoped cancel-order skill, where file access is not necessary for normal operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file’s behavior does not match the skill manifest: a skill advertised for Temu Global order cancellation includes a file-download entry point instead. This kind of capability mismatch is dangerous because it can expose unintended data-access functionality, expand the skill’s effective permission surface, and mislead reviewers or orchestrators into invoking a download path under a cancellation-only trust assumption.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation forwards an arbitrary Temu API type and arbitrary params to a generic proxy, rather than restricting requests to the cancel-order endpoints described in the skill manifest. This creates a scope-bypass/capability-expansion issue: any caller who can invoke the skill may use it as a general Temu API proxy, potentially reaching unrelated operations with the provided access token.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities that involve environment-variable access, filesystem writes, and outbound network calls, but it does not define an explicit tool scope such as permissions or allowed-tools. In an agent setting, missing scope boundaries increases the blast radius of the skill and can permit credential access, local persistence, and network exfiltration beyond what users expect from a cancellation-only integration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.