Temu欧洲站-商品管理

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:37 AM UTC
• Version: 1.0.5

Overview

The skill is mostly aligned with Temu EU product management, but it handles sensitive tokens, can change or delete live product data, includes account/payment onboarding, and stores data locally with weak safeguards.

Review this skill before installing in any real seller workspace. Only use it if you trust LinkFox as a gateway for your Temu access tokens and merchant data, keep LINKFOX/TEMU tokens out of shell history and source control, restrict endpoint override environment variables, and require explicit human confirmation before delete, full update, stock, off-shelf, compliance, or payment-order actions. Avoid using the plaintext token store on shared machines unless file permissions and retention are controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and documents use of environment variables, local file writes, and network access, but does not declare permissions or present an explicit capability boundary. This weakens user/host awareness and consent, especially because the skill sends tokens to a remote gateway and persists full API responses locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior exceeds the declared purpose by including onboarding, token management, local token persistence, generic proxying, and billing/order-related flows beyond EU product management. This scope creep is dangerous because users may invoke a narrowly described product skill while exposing credentials, payment context, or broader account actions they did not expect.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file states that the tool does not consume credits, yet earlier guidance handles insufficient balance, quota exceeded, and recharge scenarios. This inconsistency can mislead users about cost and operational side effects, undermining informed consent and potentially causing unexpected account charges or workflow changes.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The helper persistently stores full API responses plus session metadata under local directories without minimization, opt-in, or any retention controls. For a product-management skill, responses can reasonably contain product data, identifiers, operational details, and possibly tokens or other sensitive fields, so silent disk persistence expands the data-exposure surface beyond the stated API-forwarding purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements SMS verification, login, API-key issuance, package listing, order creation, and payment flows that are unrelated to the declared Temu EU product-management skill. This scope mismatch increases the chance of covert credential collection, billing abuse, or user confusion because users invoking a product-management skill would not reasonably expect account onboarding and purchase behavior. The mismatch makes the code materially more dangerous in context.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes, enabling subscription purchases that are unjustified by the stated Temu product-management purpose. In a mismatched skill, billing capabilities can be abused for unauthorized charges, deceptive upsells, or hidden monetization workflows. Because payment actions are high-trust operations, unrelated inclusion is a strong security concern.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This section performs SMS-based authentication and generates or retrieves API tokens, which is outside the stated Temu Manage Product scope. Even if intended for onboarding, embedding credential-issuance logic inside an unrelated skill creates unnecessary exposure to sensitive data and increases the blast radius if the skill is misused. The context makes it more suspicious because token acquisition is a privileged prerequisite for broader account access.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This script explicitly accepts an access token from the command line and saves it to a local token store for later reuse. In a skill whose stated purpose is proxying Manage Product API operations, introducing local credential persistence broadens the trust boundary and creates a reusable secret cache that could be exposed to other local users, processes, backups, or logs if the storage layer is not strongly protected.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This script adds a signed file download capability that is not reflected in the declared skill scope of Temu EU Manage Product APIs. Scope mismatch is dangerous because it can expose data-access behavior users and reviewers do not expect, and if the gateway accepts arbitrary signed URLs or broad tokens, the skill may be used to retrieve sensitive remote resources outside the intended product-management surface.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill mandates writing complete API responses into the current project directory, which may contain product data, compliance details, identifiers, and access-token-adjacent information. Automatic persistence without explicit opt-in or minimization increases the risk of sensitive data leakage through source control, shared workspaces, backups, or later prompt/context ingestion.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README prominently enumerates destructive and state-changing APIs such as product update, delete, stock edit, and sale-status changes without any warning, confirmation guidance, or indication that these operations can materially alter merchant data. In an agent skill context, this increases the chance that an automated system or operator triggers irreversible or business-impacting actions without sufficient user awareness or safeguards.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation describes an operation that can directly change product or SKU sale status, including taking items off-shelf, but it does not prominently warn about the business impact or require confirmation-oriented usage guidance. In an agent skill context, omission of such guardrails increases the chance that an automated workflow or a user acting on ambiguous instructions could unintentionally delist products, causing lost sales and operational disruption.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation describes a full-product update API where submitting incomplete data can overwrite existing product fields, but it does not prominently warn about destructive behavior or partial data loss. In a product-management skill, that omission is operationally dangerous because users or downstream agents may treat the call like a patch operation and unintentionally erase SKU, attribute, image, or compliance-related data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation describes a product-deletion operation but does not include an explicit warning that the action is destructive and may be irreversible. In an agent skill context, that omission increases the chance that an automated workflow or user triggers deletion without understanding the consequences, especially because the example payload is simple and ready to run.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs users to copy a Temu access token and optionally save it to a local store, but provides no guidance on secure handling, storage protections, masking, rotation, or least-privilege use. Access tokens are sensitive credentials; if they are exposed via clipboard history, logs, screenshots, or insecure local storage, an attacker could use them to access seller APIs and perform product-management actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs collecting and transmitting a user's phone number to a registration script, but it provides no privacy notice, consent guidance, retention limits, or explanation of where that data is sent and stored. In an onboarding flow tied to account creation and API key issuance, phone numbers are sensitive personal data and mishandling them can create privacy, compliance, and social-engineering risks.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation advertises high-impact product-management operations such as delete, stock edits, full/partial updates, sale status changes, and compliance edits without any explicit warning that these actions mutate live merchant data. In an agent skill context, missing guardrails can normalize destructive actions and increase the chance that an agent executes irreversible or business-critical changes without clear user confirmation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide explicitly instructs users to copy an access token and save it with a helper script, but it does not warn that the token is a sensitive credential that must be stored securely, access-restricted, and never logged or shared. In a skill whose purpose is managing Temu products and inventory, misuse or insecure storage of this token could enable unauthorized product edits, deletions, inventory changes, or other account actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper writes complete serialized API responses to disk and announces the path, but provides no warning, consent, or redaction. Because this is a shared helper for many product-management operations, the stored payloads may include sensitive business data or authentication artifacts, creating a local confidentiality risk if the host is shared or compromised.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists Temu access tokens to a local JSON file in plaintext and does not set restrictive filesystem permissions when creating or updating that file. On multi-user systems, shared environments, backups, or compromised user accounts, these credentials could be recovered and reused to manage products, inventory, listings, or deletions through the associated partner APIs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script emits the retrieved access token in plaintext to stdout inside a JSON response. In agent, automation, or gateway environments, stdout is commonly captured by logs, orchestration layers, chat transcripts, or downstream tools, which can unintentionally expose reusable credentials beyond the intended caller. In this skill context, the token grants access to Temu product-management APIs, so disclosure could enable unauthorized inventory, listing, or compliance changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code attempts to fetch or generate an API token automatically and returns it programmatically, without any in-file confirmation or warning to the operator. Silent token issuance is dangerous because it can create long-lived credentials with little user awareness, making accidental disclosure or unauthorized use more likely. In this skill, the risk is elevated by the broader scope mismatch and onboarding behavior.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The login command emits the obtained API key directly to stdout as JSON. Stdout is commonly captured by calling agents, logs, shells, CI systems, or transcripts, so this behavior can leak a sensitive credential beyond the intended recipient. In a skill ecosystem, returning secrets in normal output is particularly dangerous because downstream tools may persist or display them automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/temu_proxy.py:7