Temu美国站-取消订单

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:46 PM UTC
• Version: 1.0.6

Overview

The skill can perform Temu cancellation work, but it also exposes broad proxying, file download, onboarding/payment, and plaintext credential persistence beyond a narrowly scoped cancel-order skill.

Install only if you intentionally want a broad LinkFox/Temu gateway helper, not just a narrow cancel-order wrapper. Treat LinkFox API keys and Temu access tokens as sensitive secrets, avoid storing them in plaintext where possible, review saved response files for sensitive order data, and require explicit human confirmation before submitting any cancellation or payment-related action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 91% confidence
• Finding: The destination URL for requests.post is derived from environment-controlled base URLs via _login_base() / _agent_user_base(). Because these requests carry SMS login data, access tokens, refresh tokens, and API-token generation traffic, a malicious or compromised environment can redirect secrets to an attacker-controlled server. In a skill context, this is especially dangerous because the code is unrelated to the advertised Temu cancel-order function and performs credential onboarding and token minting instead.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: The urllib request target is built from environment-derived gateway URLs and is used with the Authorization header populated from LINKFOX_AGENT_API_KEY. If an attacker can influence environment variables, they can redirect authenticated gateway traffic, exposing API keys and order/account data to an arbitrary host. This risk is amplified by the skill mismatch: a Temu cancel-order skill should not need a generic billing/onboarding gateway path that can be externally redirected.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents capabilities to read environment variables, write files, and make outbound network requests, but does not declare permissions or narrow those capabilities. This weakens reviewability and least-privilege controls, making it easier for a user to invoke behavior that accesses secrets or persists sensitive data without clear consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a US cancel-order wrapper, but the documentation exposes substantially broader functionality including arbitrary proxying, file download, token storage, onboarding, login, API key generation, and commercial/payment flows. This description-behavior mismatch can mislead reviewers and users into granting trust to a tool that can perform more sensitive actions than expected.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: A cancellation-focused skill also documents local token storage, retrieval, listing, and authorization helper scripts. Mixing credential-management features into an operational API skill increases the chance of accidental secret exposure and expands the attack surface beyond the user's likely expectations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The presence of a generic proxy for arbitrary API types materially expands the skill from a cancellation-only wrapper into a general API execution surface. In context, this is more dangerous because the skill also handles tokens and gateway credentials, so a user may unintentionally enable unrelated or privileged actions through a misleadingly narrow interface.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: Claiming coverage of only six APIs while also documenting a generic proxy creates materially inaccurate scope claims. In security review terms, inaccurate scoping undermines trust boundaries and can hide additional reachable functionality from users and reviewers.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper unconditionally serializes and writes full API responses to local disk under a session directory. For a cancel-order skill, those responses can reasonably contain order details, buyer/seller identifiers, status metadata, and possibly token-bearing fields, creating unnecessary local persistence beyond the stated API action.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This code adds a general-purpose session logging and indexing subsystem that creates directories, metadata, and an index of activity unrelated to the narrow function of cancelling Temu orders. Expanding filesystem capabilities increases the attack surface and creates a durable audit trail of potentially sensitive operational data without clear necessity.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The script's stated purpose is to retrieve a locally stored access token, but its actual behavior prints the raw token to stdout. In agent/tooling environments, stdout is often logged, surfaced to calling layers, or exposed to users, which can cause credential disclosure and unauthorized API access.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file implements SMS login, plan listing, order creation, payment QR generation, and order-status querying, which are materially unrelated to a Temu US cancel-order skill. This functionality expansion creates an unexpected payment and account-onboarding surface that can be used to solicit credentials and purchases under a misleading skill identity. The mismatch between declared purpose and actual behavior is a strong abuse indicator.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: Most of the command handlers are devoted to LinkFox login, API-key acquisition, package purchase, and payment flows rather than Temu cancellation actions. That means the operational center of the code is credential acquisition and monetization, not the declared business purpose, which can mislead users and systems into granting permissions or trust they would not otherwise give. In security terms, this is suspicious hidden functionality, not just harmless extra code.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file implements credential persistence for Temu access tokens, which is outside the declared scope of a Temu US cancel-order skill. Scope mismatch is security-relevant because it introduces a reusable secret-handling capability that could be abused by other parts of the skill or by operators to retain credentials beyond the user's expectation. In a narrowly scoped cancellation skill, hidden token-storage functionality increases the attack surface and weakens least-privilege boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The usage and parameter handling support multiple sites and token purposes (for example site=cn and product-inventory), which are not justified by a skill described as Temu US order-cancellation. This broadens the usable scope of the stored credential mechanism, making it possible to save tokens for unrelated regions or business functions and thereby increasing the risk of cross-scope misuse or unauthorized API access.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This script adds a generic Temu signed-file download capability inside a skill whose declared purpose is cancel-order operations. That scope mismatch is dangerous because it expands the skill’s effective privileges and attack surface, enabling retrieval of arbitrary signed resources when a user or agent can supply a URL, which may expose sensitive documents or create an unintended data-exfiltration path through the LinkFox gateway.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script accepts an arbitrary user-supplied Temu API "type" and forwards it through a generic proxy, which materially exceeds the skill's declared cancel-order-only scope. In an agent ecosystem, this creates a capability-expansion vulnerability: a caller can invoke unrelated Temu operations through this skill, bypassing policy, routing, or approval controls that depend on accurate skill scoping.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The module docstring and usage examples explicitly describe and demonstrate a general-purpose Temu API proxy rather than a cancel-order-specific implementation. This mismatch increases the likelihood that integrators, agents, or reviewers will treat the skill as broader than declared, undermining trust boundaries and making misuse of unintended APIs more likely.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This script exposes a file-download capability in a skill whose declared purpose is Temu US order cancellation. Even without seeing the helper implementation, accepting a user-supplied URL and forwarding it to a download endpoint creates scope creep and can enable unintended data retrieval or SSRF-style access through the gateway if not strictly constrained. The mismatch between manifest scope and implemented behavior makes the capability more suspicious and more dangerous in an agent setting, because users and reviewers may not expect network file access here.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code loads arbitrary JSON input, including a caller-controlled "url", and passes it to us_file_download_call with no visible validation. A generic remote download primitive is dangerous because it can be abused to fetch attacker-chosen resources, potentially including internal services or sensitive files exposed via the upstream download mechanism, and its presence is not justified by the stated cancellation-only business function. In this skill context, the capability is more dangerous because it is hidden inside an unrelated operational workflow, reducing the chance that users or reviewers will apply stricter scrutiny.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger conditions are broad and keyword-based, which can cause the skill to activate in contexts where the user did not intend to invoke cancellation tooling. Because the skill can access networked APIs and local persistence, over-broad activation raises the risk of unintended sensitive operations or data handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that full API responses are always persisted locally, but does not present a prominent user-facing warning or safeguards around sensitive data handling. Cancellation and order APIs commonly contain identifiers, addresses, status details, and possibly token-adjacent metadata, so mandatory persistence increases confidentiality risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly recommends storing a Temu access token on disk and provides commands to save and reuse it, but it does not warn that the token is sensitive, should be protected with restrictive file permissions, or should preferably be stored in a secure secret store. Because this skill handles order cancellation and related seller/buyer operations, compromise of the locally stored token could allow unauthorized API access and business actions against the user's Temu account.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This documentation describes an order-cancellation workflow that can materially affect fulfillment and customer transactions, but it does not include any explicit warning, confirmation requirement, or operator guidance about business consequences and authorization. In the context of a skill that helps trigger Temu US cancellation actions through a gateway, omission of such safeguards increases the risk of accidental or unauthorized cancellation requests.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs users to copy an access token from the Temu seller backend and optionally save it to a local store, but it provides no warning that the token is a sensitive credential or guidance on secure storage and handling. In the context of an authorization flow for order and after-sales APIs, exposing or insecurely storing this token could let an attacker reuse it to access shop data or perform unauthorized operations through the proxy.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The onboarding flow instructs operators to collect and submit a user's phone number and one-time verification code through a script, but it provides no privacy notice, consent language, data-handling constraints, or masking guidance. Because OTPs are highly sensitive authentication factors, this creates avoidable risk of credential interception, account takeover, or improper retention if the workflow is followed casually or logged.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.