Temu欧洲站-发货

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:33 AM UTC
• Version: 1.0.5

Overview

This skill mostly matches a Temu EU fulfillment tool, but it also includes broad credential, payment, generic proxy, and persistent data-retention behavior that users should review carefully before installing.

Install only if you intend to let this skill handle live Temu EU fulfillment through LinkFox. Review where it stores full responses and Temu tokens, avoid using real credentials in shared chats or logs, confirm every shipment/cancellation/payment action manually, and avoid environment URL overrides unless you fully control the target service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 90% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions while clearly requiring environment variable access, network calls, and persistent file writes. This weakens user and platform trust boundaries because operators may invoke a skill without understanding it can exfiltrate data over the network and store sensitive fulfillment responses locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is narrowly framed as Temu EU fulfillment, but the detected behavior includes account onboarding, API key generation/retrieval, plan purchasing and payment flows, token storage/listing, token validity checks, and generic proxy/file-download capabilities beyond EU fulfillment. This scope expansion is dangerous because it enables unrelated high-risk actions involving credentials, billing, and broader API access under a misleading description, reducing informed consent and increasing the chance of misuse.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The site mapping table incorrectly labels `us` as Europe while the rest of the document consistently uses `eu` for Europe. In a credential-handling guide, this can cause operators to request, store, or use the wrong regional token and send fulfillment or shipping API calls to the wrong Temu gateway, leading to failed operations, data misrouting, or accidental disclosure to an unintended regional environment.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The shared emit_result() helper persistently writes full API responses to local disk for every invocation, regardless of whether the response contains order, shipment, customer, tracking, or token-adjacent data. In a fulfillment/shipping skill, API responses can reasonably include sensitive business or personal data, so automatic archival expands data retention beyond the operational need of making the API call.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code creates a cross-session archive structure under a shared linkfox directory and maintains metadata/index files that track sessions, skills called, and saved data files over time. This broadens collection and retention scope beyond a simple shipping API helper and increases the blast radius if the local host, workspace, or temp directory is accessed by another process or user.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script retrieves and returns a generic Temu access token based on caller-supplied parameters, with no restriction that the token be limited to fulfillment-only use despite the skill being described as fulfillment-specific. In an agent/tooling context, this creates a scope-expansion risk where the skill can be used to access unrelated Temu capabilities if such tokens are present in the local store.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The docstring example explicitly demonstrates requesting a token for "product-inventory," which is outside the stated fulfillment scope of the skill. That mismatch encourages operators or downstream agents to use the script for broader account access than intended, weakening least-privilege boundaries and increasing the chance of credential misuse.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS login, API-key retrieval, subscription plan listing, payment-order creation, and order-status polling, none of which align with a Temu EU fulfillment skill. The mismatch greatly increases risk because the skill can socially engineer users into authenticating to a separate service and minting credentials unrelated to the declared purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Subscription commerce and payment QR generation are unrelated to order fulfillment APIs and create a direct monetization path inside the skill. In this context, that capability is suspicious because it can induce users to pay for external plans under the guise of a logistics integration workflow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code retrieves or generates LinkFox API tokens after SMS login, which exceeds the stated Temu shipping use case and creates a credential-issuance mechanism inside the skill. Because the skill can output those tokens directly, it materially increases the risk of unauthorized account access and secret leakage.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases include broad English shipping terms like tracking and order-shipping, which can match ordinary user requests outside the intended Temu EU context. Over-broad activation increases the risk that the skill is invoked on irrelevant conversations, causing unintended network requests, local persistence of data, or use of external credentials in the wrong context.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that full API responses are always written to disk, but it does not require a user-facing warning or consent for local persistence. Because fulfillment responses may contain order identifiers, addresses, tracking numbers, and other operational data, silent persistence increases privacy and data-retention risk, especially in shared project directories.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document recommends saving Temu access tokens to a local JSON file but does not clearly warn that the file contains long-lived sensitive credentials or provide minimum storage protections. In this skill context, those tokens authorize shipping and fulfillment operations, so insecure local storage increases the risk of credential theft, unauthorized API use, and downstream order or logistics abuse if the workstation or home directory is exposed.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: This documentation describes operationally destructive or state-changing fulfillment actions such as shipment creation, pickup reservation/cancellation, scan form creation, and shipped-package confirmation without explicit warnings about real-world consequences. In an agent context, that increases the risk that a model or operator triggers irreversible shipping actions, cancels logistics, or marks orders shipped without sufficient confirmation, causing fulfillment errors and business harm.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The authentication section instructs users to supply sensitive LinkFox and Temu credentials in headers, environment variables, or JSON body fields, but does not warn about secrecy, logging exposure, or least-privilege handling. In agent/tooling environments, tokens placed in request bodies or examples are especially prone to accidental disclosure through logs, transcripts, debugging output, or prompt injection-induced exfiltration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation exposes a destructive cancellation action for fulfillment orders and includes ready-to-run examples, but it does not prominently warn users that the operation can cancel warehouse processing and affect order shipment workflows. In an agent skill context, omission of an explicit destructive-action warning increases the risk of accidental misuse or unsafe automation, especially when triggered from natural-language requests about shipping or fulfillment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document instructs users to submit fulfillment orders, tracking numbers, warehouse/customer identifiers, and potentially shipping label contents to an external Temu/cooperative-warehouse API, but it does not clearly warn that sensitive order and shipping data will leave the agent and be transmitted to a third party. In an agent setting, this can lead to unintended disclosure of customer/order data or label artifacts when a user does not realize the action is an outbound data-sharing operation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to provide highly sensitive credentials such as `cwAccessToken`, `cwCustomerCode`, and optionally `cwAppKey`, but it does not warn against logging, sharing, storing, or exposing them in examples, terminals, chat transcripts, or version control. In this skill context, those values authorize cooperative warehouse operations for a Temu shop, so accidental disclosure could let an attacker bind or abuse fulfillment capabilities tied to the merchant account.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation describes an operation that changes order state from pending shipment to shipped, but it does not prominently warn that invoking it performs a real business action with potentially irreversible operational and customer-service consequences. In an agent skill context, omission of such safeguards increases the chance an automated system or user triggers live fulfillment unintentionally, especially because the page frames the call as a normal workflow step.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples provide ready-to-run commands for confirming shipment against a live API but do not label them as production-impacting operations or include a warning to avoid running them with real tokens unless the user has explicitly approved fulfillment. In a fulfillment skill, executable examples materially increase the risk of accidental shipment confirmation by operators or downstream agents.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the operator to collect and submit a user's phone number to a registration script, but it provides no privacy notice, consent guidance, retention limits, or warning about handling personal data. In a support/onboarding flow, this creates avoidable privacy and compliance risk because the agent may solicit sensitive contact data without informing the user how it will be used or protected.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guide explicitly instructs users to copy an access token and save it via a script, but it does not warn that the token is a sensitive credential requiring secure storage and restricted handling. In this skill context, the token grants access to Temu seller APIs for order and shipping operations, so weak handling guidance can lead to credential leakage, unauthorized API use, or account abuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Full API responses are written to disk without any user-facing consent, warning, or indication in this file that sensitive fulfillment data may be retained locally. Silent persistence of operational data is risky because users may assume the skill only proxies API calls, while it actually creates local records that can expose order and shipping information.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/temu_proxy.py:7