Temu类目搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.9

Overview

This skill is mainly a Temu category search helper, but it also includes account login, API key generation, and payment-order flows that users should review carefully before installing.

Install only if you are comfortable with a LinkFox-hosted workflow that uses an API key, can guide users through phone/SMS login, may generate and display API keys, and can create payment orders. Prefer the self-service key path, avoid sharing SMS codes with an agent unless you trust the publisher, and review where response files and QR artifacts are stored.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: The POST destination is derived from helper functions that accept environment-variable overrides for base URLs, and this request can carry sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens. In a skill context, allowing untrusted environment configuration to redirect these authenticated requests can exfiltrate credentials to attacker-controlled endpoints.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: The gateway request target is built from environment-controlled base URLs and then invoked with Authorization headers containing the agent API key. If an attacker can influence environment variables, they can redirect authenticated API traffic and harvest secrets or manipulate billing/order flows.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 96% confidence
• Finding: The request sent via urlopen includes multiple environment-derived values in HTTP headers, including an API key and session metadata, and the destination base URL is also overrideable by the LINKFOX_TOOL_GATEWAY environment variable. In an agent setting, this creates a real exfiltration path: if an attacker can influence environment variables or execution context, secrets and task metadata can be sent to an arbitrary remote server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares itself as a local category search helper, but the content explicitly references environment-variable API keys, a Python script, and remote documentation, which indicates undisclosed capabilities involving environment access, file/script execution paths, and networked API use. Undeclared capabilities reduce auditability and can cause the agent to invoke external resources or handle secrets without the operator understanding the true trust boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a significant description-behavior mismatch: a supposedly local category lookup skill appears to include account onboarding, SMS login, API-key retrieval, billing, payment, and remote API access. Such hidden behavior can expose users to credential collection, unexpected external data transfer, and unauthorized commercial/account actions far beyond the narrow category-search purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements LinkFox account onboarding, SMS verification, login, API key retrieval, package listing, order creation, and payment QR generation, which is unrelated to the declared Temu category-search purpose. Such a severe skill-purpose mismatch is a strong indicator of covert credential collection and monetization behavior hidden inside an unrelated skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing and payment-order functionality has no legitimate connection to searching a local Temu category database by keyword. Embedding purchase flows in this skill expands the attack surface to unauthorized charges, deceptive payment prompting, and exfiltration of order/payment metadata.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: SMS-based login and API key issuance are highly sensitive account operations that are unjustified for a local category-search skill. In this context, the code can collect phone numbers and verification codes, obtain access tokens, and generate API keys, enabling full account compromise or persistent unauthorized access.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: The script creates session directories and writes QR image artifacts to local storage, despite the skill being described as a local Temu category lookup. While file writes alone are not inherently malicious, in this context they support unrelated payment/onboarding flows and can leave behind sensitive artifacts accessible to other local users or processes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata says it searches locally synced Temu category data, but the implementation actually posts user parameters and agent metadata to a remote LinkFox gateway. This mismatch is security-relevant because users and calling systems may assume no external data transfer occurs, leading to unintended disclosure and trust-boundary violations.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module documentation promises writes only under the current working directory and explicitly forbids /tmp, yet the actual code falls back to the home directory and finally the system temp directory. This inconsistency can cause sensitive API responses to be written to less controlled or more broadly accessible locations than operators expect.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation rule is overly broad because it triggers even when the user does not explicitly mention the tool, based on generic category-ID lookup intent. That increases the chance of accidental invocation of a skill with hidden remote/auth/payment behavior, causing unintended data disclosure or side effects.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding flow explicitly asks the agent to collect a user's phone number and use it in registration and login commands, but it provides no requirement to obtain informed consent, explain data handling, or minimize retention of personal data. In an agent context, this creates a privacy and social-engineering risk because users may disclose sensitive identifiers without understanding where they are sent or how they are stored.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code retrieves or generates an API token and returns it in CLI output without any built-in warning, redaction, or secure handling guidance. Exposing newly minted credentials in normal output increases the chance of leakage through logs, transcripts, shell history capture, or downstream tooling.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 76% confidence
• Finding: This code transmits data to external services using requests.post, including sensitive onboarding and authentication information. External transmission is especially dangerous here because the skill’s declared purpose does not require any remote login or payment operations, so users would not reasonably expect this data flow.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 72% confidence
• Finding: The alternate environment variable name provides another path for harvesting an agent API key and using it in downstream authenticated requests. In isolation this is standard secret retrieval, but within an unrelated skill it increases the risk of silent credential use outside user expectations.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _api_key() -> str:
    return os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") or ""


def _mask_phone(phone: str) -> str:

• Confidence: 72% confidence
• Finding: The alternate environment variable name provides another path for harvesting an agent API key and using it in downstream authenticated requests. In isolation this is standard secret retrieval, but within an unrelated skill it increases the risk of silent credential use outside user expectations.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.