Security audit

Temu全球站-发货

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Temu fulfillment integration, but it needs Review because it stores and can print credentials, persists full fulfillment responses, and includes account/billing flows beyond shipping.

Install only if you are comfortable with a third-party LinkFox gateway receiving Temu fulfillment data and credentials. Treat all Temu access tokens and LinkFox API keys like passwords, avoid unmasked token listing, review saved files under the linkfox and ~/.linkfox paths, and require explicit human confirmation before creating, confirming, updating, or cancelling shipments or payment orders.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents use of environment variables, local file writes, and outbound network access, but does not declare permissions or provide an explicit capability boundary. This matters because the skill automatically persists full API responses locally and sends fulfillment data to an external gateway, increasing the chance of unintended data exposure or overbroad execution in hosts that rely on declared permissions for enforcement or user consent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: A description-behavior mismatch is a serious trust and security problem because users may invoke a shipping-only skill while it also supports onboarding, login, payment/order flows, token handling, and local token storage. Those extra capabilities touch authentication secrets, billing actions, and persistent credentials, which materially expands the attack surface beyond what the skill advertises.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The skill gives contradictory statements about billing/points consumption, first warning that calls consume credits and later claiming they do not. This can mislead users into approving additional calls they would otherwise decline, undermining informed consent and potentially causing financial impact or abusive repeated requests.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document describes a global-site fulfillment skill, but the request-body table says the required `site` value is `us` while elsewhere the file says the default is `site=global`. In a shipping/fulfillment context, this inconsistency can cause requests to be routed to the wrong marketplace, leading to failed operations, incorrect token usage, or accidental actions against the wrong environment/account scope.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The helper always serializes and saves full API responses to local disk, regardless of whether those responses contain shipment details, addresses, tracking data, store identifiers, or tokens echoed by upstream services. Because this is a shared module used by fulfillment operations, the persistence is broad in scope and creates unnecessary data retention and local exposure risk beyond the core API function.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code creates a reusable cross-session storage area under predictable directories and maintains an index of session activity. This expands the blast radius of any local compromise or accidental disclosure because data from multiple runs and skills can accumulate in one place and remain discoverable over time.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script is a general-purpose token retrieval utility that returns any stored Temu access token based on caller-supplied store, site, management type, and token purpose. In a skill scoped to fulfillment-global operations, exposing a broad token accessor increases the chance of cross-scope credential use and unauthorized API access if other parts of the agent can invoke it with arbitrary parameters.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This script enumerates locally saved Temu access tokens and can optionally print them unmasked via a user-controlled parameter. Exposing authentication tokens is sensitive by itself, and this capability is not necessary for a fulfillment/shipping skill, so it increases the chance of credential disclosure through operator misuse, log capture, or abuse by other components.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file implements SMS login, token exchange, and API-key issuance workflows that are unrelated to the advertised Temu Global fulfillment/shipping purpose. In a skill context, this expands privileges and collects sensitive credentials far beyond least-privilege, increasing the chance of credential theft, unauthorized account access, or misuse under the guise of a shipping integration.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code contains plan listing, ordering, and payment QR generation capabilities that are outside the declared fulfillment API scope. In a shipping skill, embedding commerce and payment operations creates unnecessary financial-action surface and could trigger unintended purchases or social-engineering-style payment requests.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: This script explicitly persists a Temu access token to a local store for later reuse, creating a credential-at-rest exposure. In the stated skill context, which is focused on fulfillment/shipping APIs, local token storage is a broader capability than necessary and increases the risk of credential theft, unintended reuse across workflows, or leakage from the host environment.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The file adds a credential persistence mechanism that is not obviously required by the manifest-described fulfillment-only behavior, which broadens the skill's effective privilege surface. Even if intended for convenience, storing reusable bearer tokens locally can enable unauthorized API actions if the local store, logs, backups, or surrounding environment are compromised.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill states that it always writes complete API responses to local files, but the description lacks a prominent user warning and consent mechanism for this persistence. Fulfillment responses can contain order, shipment, tracking, address, or token-adjacent data, so silent persistence increases the risk of sensitive business or personal data remaining on disk longer than intended.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document explicitly recommends storing Temu access tokens on disk in a predictable local path, but it does not warn that these are sensitive credentials or instruct users to protect the file with restrictive permissions, encryption, or secret-management controls. If the workstation is shared, compromised, backed up insecurely, or inspected by other local users or processes, the token could be stolen and used to access Temu business APIs and perform unauthorized shipping or order-related actions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation instructs users to provide third-party warehouse credentials such as cwAccessToken and cwCustomerCode, but it does not explicitly warn that these are sensitive secrets that must not be exposed in logs, examples, chat transcripts, or shared outputs. In an agent-skill context, users may paste real production tokens into requests, and those credentials could be retained, echoed, or mishandled by downstream tooling, enabling unauthorized warehouse or fulfillment actions.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This documentation describes an operation that cancels a pickup reservation but does not prominently warn that the action is state-changing and may be irreversible or operationally disruptive. In a fulfillment/shipping context, a user or downstream agent could invoke it without sufficient confirmation, leading to missed pickups, shipment delays, or disruption of order handling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document instructs users to copy a Temu access token and optionally save it to a local store, but it does not warn that the token is a sensitive credential or describe storage and handling requirements. In this skill’s context, the token appears sufficient to authorize order, shipping, and fulfillment API operations, so insecure local storage or casual sharing could enable unauthorized access to seller operations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The onboarding instructions direct operators to collect and pass a user's phone number and verification code into a script, but they do not include any privacy notice, consent guidance, data handling limits, or retention/deletion expectations. This creates a real privacy and compliance risk because the skill operationalizes collection of personal data without clear safeguards, especially in a support workflow where users may feel pressured to disclose it.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The catalog explicitly exposes shipment creation, update, confirmation, cancellation, pickup reservation, and fulfillment submission actions, but does not warn that these operations mutate real order and shipment state. In an agent setting, missing guardrails can cause accidental execution of high-impact logistics actions, leading to incorrect fulfillment, cancellations, or irreversible shipment state changes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide explicitly tells users to copy and save an access token but does not clearly label the token as a sensitive secret or instruct secure storage/handling. In an auth-guide skill, this omission increases the chance of credential exposure through logs, screenshots, chat transcripts, or insecure files, which could enable unauthorized API access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The step-by-step instructions repeatedly direct users to copy access tokens and save or use them, but they provide no visible warning about secure handling. Because this skill is specifically an authorization workflow, normalizing manual token copying without guardrails makes accidental disclosure more likely and can directly expose shipping/order API access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The module writes full API responses to disk without any disclosure or consent mechanism in this file. In a fulfillment/shipping context, responses may include personal and operational data, so silent persistence undermines user expectations and can expose sensitive information to other local users or later processes.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script prints the raw access token to stdout in JSON, which can be captured by logs, agent transcripts, shell history wrappers, or downstream tools. Because bearer tokens grant direct API access, any unintended disclosure can let an attacker act as the store until the token expires or is revoked.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The login flow retrieves an API key and emits it in stdout JSON without any built-in warning, redaction, or secure storage guidance. In agent environments where outputs may be logged, persisted, or shown to other components, this can expose long-lived credentials and enable unauthorized API use.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The usage text instructs operators to paste an access token into a script that saves it locally, but it provides no warning that a sensitive credential will be persisted. That increases the chance users expose long-lived bearer tokens without understanding retention or local compromise risks, especially in shared workstations, shell history, backups, or developer environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/temu_proxy.py:7