Temu全球站-合规

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:49 PM UTC
• Version: 1.0.6

Overview

The skill is a real Temu compliance integration, but it exposes broader account, token, billing, proxy, and persistence capabilities than a narrow 9-endpoint compliance wrapper should.

Install only if you need a broad LinkFox/Temu operator tool, not just a narrow compliance helper. Treat LinkFox API keys and Temu access tokens as secrets, avoid using the raw token export/list commands, review saved files under linkfox directories and ~/.linkfox, confirm any payment order manually, and restrict use to trusted environments and expected LinkFox gateway URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST target is ultimately derived from environment-controlled base URLs, and this function sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence the environment, they can redirect authentication traffic to an attacker-controlled server and exfiltrate credentials or session material.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: Gateway requests use a URL built from environment-derived base configuration and attach the API key in the Authorization header. If the environment is manipulated, requests can be redirected to an attacker-controlled host, leaking the API key and enabling unauthorized use of the account or downstream services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents use of environment variables, local file writes, and outbound network access but does not declare those permissions. Hidden or undocumented capabilities reduce user/operator visibility into what the skill can access, undermining least-privilege review and making sensitive operations harder to govern. In this context, the skill handles API keys, tokens, and compliance payloads, so undeclared capabilities increase the risk of accidental exposure or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a narrow 9-endpoint Temu Global compliance wrapper, but the behavior described by analysis includes generic proxying, signed file download, token storage/retrieval, token validation, and onboarding/payment-related account flows. This mismatch is dangerous because users and reviewers may authorize a limited compliance tool while actually exposing broader account, token, and network capabilities that can be abused for unauthorized API calls or sensitive data handling.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The document says the tool consumes points and warns against repeated retries, but later states that it does not consume points. Conflicting billing semantics can mislead users or calling agents into making unintended repeated calls, causing unexpected charges, quota exhaustion, or unsafe automated behavior based on false assumptions about cost.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The helper unconditionally writes full API responses to local disk, which can include sensitive business data, access tokens returned by upstream services, compliance documents, or user-provided content. For a skill whose stated purpose is forwarding Temu compliance API calls, broad persistent storage is an unnecessary expansion of data handling and creates a local disclosure/retention risk if the host is shared or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The code creates a reusable cross-session storage root and index under multiple filesystem locations, enabling accumulation and later discovery of prior session outputs. That capability is not necessary for simple API proxying and increases the blast radius of any sensitive data captured from compliance operations across runs and users.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This script introduces credential-retrieval behavior that is broader than the skill's declared Temu compliance/API proxy purpose. Even if intended for operational convenience, exposing a local token-export utility inside a compliance-focused skill expands the trust boundary and creates an avenue for credential access unrelated to the stated function.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script retrieves a stored access token and prints the raw credential in JSON output, making secret exfiltration trivial for any caller able to invoke it. In the context of a compliance skill, this is especially unjustified because the token can likely be reused to access broader Temu APIs or impersonate the store account.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This script enumerates locally stored Temu access tokens and explicitly supports disabling masking, which can reveal full bearer credentials to any user or process able to invoke it. Access tokens are secrets that may grant API access and account actions; exposing them is not necessary for a compliance-focused skill and increases the risk of credential theft, logging leakage, and lateral misuse.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements SMS login, token acquisition, user/team enumeration, API-key generation, and purchasing flows, which are unrelated to a Temu Global compliance skill. That scope mismatch is dangerous because it collects credentials and provisions paid access outside the declared purpose of the skill, increasing the likelihood of unauthorized account onboarding and secret harvesting.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can list purchasable plans, create orders, and render payment QR codes, introducing financial transaction capability unrelated to compliance functionality. In the context of this skill, that expands risk from data handling to unauthorized purchases, social engineering, and monetization abuse under the guise of compliance assistance.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The script adds credential-storage functionality that is outside the described compliance API proxy scope, increasing the skill's privilege and data-handling surface beyond what users would reasonably expect. Even if not overtly malicious, storing reusable access tokens locally enables later use in proxy or file-download flows and creates a security-sensitive capability not clearly tied to the stated compliance purpose.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The code persists an access token to a local store without showing that such persistence is necessary for the compliance-related operations described by the skill. Unnecessary local credential storage increases the risk of token theft, accidental reuse across contexts, and misuse of long-lived credentials if the host or store is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script is a generic proxy that forwards an arbitrary API type from user-controlled input to `global_proxy_call`, while the skill is advertised as limited to Temu Global compliance operations. This creates a scope-break issue: a caller may invoke non-compliance Global APIs through the skill, potentially bypassing intended policy restrictions, review assumptions, or least-privilege boundaries.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The inline documentation describes a generic product/API proxy despite the skill metadata presenting a compliance-focused capability, indicating implementation-documentation mismatch. That mismatch is dangerous because operators, reviewers, and downstream policy controls may treat the skill as narrow-scope when it actually exposes broader API reach, increasing the chance of unauthorized or unsafe use.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is implemented as a generic Temu proxy because it accepts an arbitrary API `type` from user input and forwards it through a common proxy endpoint, rather than constraining calls to the 9 global compliance APIs described in the manifest. In a skill ecosystem, this enables scope expansion beyond the declared capability, potentially allowing unauthorized access to unrelated Temu functions and making review, permissioning, and monitoring less reliable.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The usage examples and documentation explicitly advertise `site: "cn"`, which contradicts the skill’s stated purpose of global compliance operations. This mismatch increases the likelihood of operators or downstream agents invoking the skill outside its approved scope, undermining trust boundaries and potentially exposing non-global APIs or data paths.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly instructs users to upload product certification, qualification documents, and real product images to a remote API, but it does not warn that these materials may contain sensitive commercial, compliance, or personal data. In an agent skill context, this omission can cause unintentional exfiltration of sensitive files or URLs to an external service without informed user consent or data-handling guidance.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to upload compliance-related files as base64 and to invoke the API with access credentials, but it does not warn that the file contents and tokens are sensitive and will be transmitted to a remote third-party service. In a compliance workflow, uploaded files may contain regulated product documentation, certificates, images, or other sensitive business data, so lack of explicit handling guidance increases the risk of accidental exposure through logs, prompts, terminal history, or inappropriate user submission.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation describes a write operation that edits live product compliance/governance data but does not clearly warn that invoking it can change production compliance records. In a commerce compliance context, accidental misuse could alter GPSR, certificates, or governance attributes, causing incorrect regulatory data, listing issues, or business disruption.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs users to submit a base64-encoded product image and an access token to an external compliance API, but it does not warn that images may contain sensitive business data, metadata, or personal information and will leave the local environment. In an agent setting, this omission can cause unintentional exfiltration of sensitive content because users may assume the upload is a routine local transformation rather than transmission to a third-party service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to copy a Temu access token from the seller backend and optionally save it locally, but it does not warn that the token is a sensitive bearer credential or describe safe handling requirements. In a skill centered on proxying compliance and seller-platform API access, this increases the chance of credential leakage, reuse from insecure local storage, or accidental exposure in logs or screenshots.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions direct the operator to collect a user's phone number and use it to trigger registration and login flows, but they provide no consent language, retention limits, masking guidance, or warning about handling one-time codes and account data. In an agent skill context, this creates unnecessary exposure of personal data and increases the risk of privacy violations, social engineering, or leakage through logs and transcripts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Responses are saved locally without any explicit user-facing notice or consent mechanism, so operators may not realize sensitive compliance payloads are being retained. Hidden persistence is risky because users may provide store identifiers, certificates, or other regulated material under the assumption the tool only forwards API requests.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/temu_proxy.py:7