Temu美国站-发货

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:37 AM UTC
• Version: 1.0.5

Overview

This skill is mainly a Temu fulfillment tool, but it also handles credentials, local token storage, account onboarding, and payment flows with weak scoping and safety warnings.

Review carefully before installing. Use only trusted LinkFox endpoints, avoid overriding gateway/login URL environment variables, do not paste production tokens into shell commands or shared chats, secure or delete ~/.linkfox/temu-access-tokens.json if used, and require explicit human confirmation before purchases, shipment creation, shipment confirmation, fulfillment cancellation, or file downloads.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises capabilities that read environment variables, write files, and perform network requests, yet it declares no explicit permissions or guardrails. This weakens policy enforcement and user understanding, making it easier for sensitive actions like credential use, local persistence, and outbound API calls to occur without clear consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a US fulfillment/shipping skill, but the skill behavior reportedly includes onboarding, API-key generation/retrieval, subscription and purchase workflows, payment QR rendering, generic proxy access, and token-management utilities. That scope expansion is dangerous because it enables credential handling, billing actions, and broader platform access than users would reasonably expect from a shipping skill.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file adds account onboarding, login, API key retrieval, and billing/payment workflows that are outside the stated Temu fulfillment function of the skill. This expands the skill's operational scope into credential handling and payments, increasing phishing, account takeover, and unauthorized payment risk if the agent follows these instructions automatically or asks users for sensitive data.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This file implements account onboarding, plan listing, order creation, payment QR generation, and payment-status querying, which are unrelated to the stated Temu US fulfillment purpose. That scope mismatch is dangerous because a user invoking a logistics skill would not reasonably expect embedded billing and account-provisioning behavior, increasing the risk of deceptive or unintended financial/account actions.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The operational behavior of the file is centered on LinkFox login, token exchange, API-key generation, package purchase, and payment handling rather than Temu fulfillment APIs described in the metadata. In the skill context, this mismatch is especially risky because it can mislead users into divulging phone verification codes and enabling account/billing operations under the guise of shipment management.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: This script explicitly accepts a Temu access token and stores it locally for later reuse, creating a persistent credential store. That expands the attack surface because any local compromise, accidental file exposure, weak file permissions, or downstream misuse of the token store could allow unauthorized API access; in a fulfillment/shipping skill, persistent credential handling is ancillary and therefore less expected and more risky.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger conditions include broad phrases such as shipping, tracking, and order-shipping references that may cause the skill to activate outside its intended context. Over-broad invocation increases the chance of unintended API calls, exposure of unrelated fulfillment data, or routing user requests into a skill with network and file-write side effects.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly recommends storing a Temu access token locally and shows commands that persist the secret, but it does not clearly warn that the token is sensitive credential material or describe the risks of plaintext local storage. If the token store file is readable by other local users, included in backups, synced to cloud storage, or accidentally committed, an attacker could reuse the token to access Temu business APIs and perform shipping or fulfillment actions tied to the seller account.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example encourages passing a live Temu access token directly on the command line, which is commonly exposed via shell history, process listings, CI logs, and terminal recordings. Because this skill handles shipping and fulfillment operations, token disclosure could let an attacker create labels, confirm shipments, or otherwise manipulate order-fulfillment actions through the documented proxy.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation exposes a destructive cancellation capability for cooperative-warehouse fulfillment orders but does not clearly warn that the action may be irreversible, time-sensitive, or operationally disruptive once invoked. In an agent skill context, omission of explicit confirmation and impact guidance can cause an autonomous or hurried user workflow to cancel live fulfillment unintentionally, leading to shipment disruption, inventory/ERP inconsistency, and customer-impacting order failures.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented examples invoke a fulfillment submission API that can create real warehouse/shipping records, yet the examples are presented like ordinary test snippets without a clear warning that they have live external side effects. In an agent skill context, this increases the chance that a user or downstream agent will execute the sample payloads in production-like environments, causing unintended fulfillment actions, label creation, or shipment state changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to provide third-party credentials such as `cwAccessToken`, `cwCustomerCode`, and optionally `cwAppKey` to bind a warehouse provider, but it gives no warning that these are sensitive secrets requiring careful handling. In an agent skill context, users may paste live credentials into prompts, logs, examples, or shared transcripts, increasing the risk of credential leakage and unauthorized access to cooperative warehouse integrations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation describes an API that can create shipping orders, buy labels, and in some modes immediately mark packages as shipped, but it does not prominently warn that these actions have real-world operational and financial consequences. In an agent skill context, that omission increases the risk of accidental fulfillment actions, unwanted charges, or incorrect shipment state transitions if a user or upstream workflow invokes it without explicit confirmation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document describes an API that explicitly changes an order from pending shipment to shipped, but it does not prominently warn that this is a state-changing business action that may be difficult or impossible to reverse. In an agent skill context, examples and workflow guidance can be used directly by automation, so missing confirmation/guardrail language increases the risk of accidental or unauthorized fulfillment actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document tells users to copy an access token from the Temu seller backend and optionally save it locally, but it gives no warning that the token is a sensitive credential equivalent to API authorization. In a fulfillment/shipping skill, such a token could allow unauthorized access to orders, shipment actions, tracking data, or other seller operations if exposed through screenshots, logs, clipboard history, or insecure local storage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API guidance explicitly describes passing access tokens directly to tools and proxy endpoints, but does not warn that this transmits credential material across additional components and increases exposure in logs, traces, shell history, and intermediary systems. Because this skill is specifically for Temu US fulfillment operations, compromise of the token could enable unauthorized shipment creation, label purchase, warehouse actions, or access to order/shipping data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions direct the agent to collect a user's phone number and use it in a script-driven registration/login flow, but they provide no privacy notice, consent language, retention limits, or disclosure about where the data is transmitted. In a support skill unrelated to fulfillment operations, this creates unnecessary exposure of personal data and could facilitate credential interception or misuse of verification flows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The catalog explicitly advertises a generic `temu_us_proxy` that can invoke arbitrary `type` values and a signed file download helper, but it does not warn that these capabilities may access or transfer sensitive fulfillment data such as labels, shipment documents, tracking, and warehouse-related records. In a fulfillment skill, this broad invocation surface increases the risk of overbroad data access, misuse of tokens, and accidental retrieval or transmission of sensitive operational documents if downstream controls are weak or users are not clearly informed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persists Temu access tokens to a local JSON file in plaintext without any protection, permission hardening, encryption, or user-visible warning. Because these are bearer credentials, any local user, malware, backup system, or accidentally shared home directory contents could expose them and allow unauthorized API access to seller fulfillment operations.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The file-download helper forwards both an access token and a user-supplied URL to a remote download endpoint. If the backend fetches the supplied URL without strict validation, this creates an SSRF-style trust-boundary issue and may allow internal resource access, credential leakage, or misuse of authenticated download workflows through the proxy.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script prints the retrieved Temu access token directly to stdout in JSON output. In agent, CI/CD, or toolchain contexts, stdout is commonly logged, captured in transcripts, or surfaced to other components, which can unintentionally disclose a live credential and enable unauthorized API access.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The login flow acquires an API key and emits it directly in stdout JSON without an in-file warning, masking only the phone number. In an agent/tooling environment, stdout is often logged, relayed, or stored by hosts, so exposing long-lived API credentials this way can lead to credential leakage beyond the immediate user session.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The usage example instructs users to pass the access token directly on the command line and the script provides no warning that the credential will be persisted locally. Command-line secrets can leak through shell history, process listings, logs, and support transcripts, and undisclosed local storage increases the chance that operators expose or mishandle long-lived credentials.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/temu_proxy.py:7