Temu全球站-商品管理

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:36 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches Temu product management, but it also includes broad proxy, billing, credential, and local data-retention behavior that users should review before installing.

Install only if you trust LinkFox and are comfortable with this skill sending LinkFox and Temu credentials through its gateway, storing Temu tokens and full API responses locally, and exposing product mutation/delete plus billing-onboarding scripts. Review the conflicting points/cost language and avoid using the generic proxy or payment commands unless you explicitly intend those actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill exposes environment-variable access, file writes, and network operations but does not declare permissions or clearly bound those capabilities. This reduces transparency and weakens policy enforcement, making it easier for the skill to access secrets, persist sensitive data, and contact external services without an explicit trust decision by the operator.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is a narrowly scoped Temu Global product-management skill, but the content also includes onboarding, API-key generation/retrieval, payment-plan and order flows, generic proxying, file download, and local token management. This mismatch is dangerous because reviewers and users may authorize the skill for a limited business action while it actually supports broader account, billing, credential, and arbitrary proxy operations.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The skill states both that use incurs points/cost constraints and later that it does not consume points, creating conflicting operator guidance. In a system that can trigger paid external actions, contradictory cost semantics can cause unintended repeated calls, user deception, or bypass of approval expectations around billable operations.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper unconditionally writes full API responses to local disk under a session directory and also prints summaries of the content. Those responses may contain access tokens, product metadata, store identifiers, pricing, inventory, or other sensitive business data, creating unnecessary persistence and a secondary disclosure path beyond the stated API-forwarding role.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements LinkFox onboarding, login, package listing, order creation, and payment workflows, which are unrelated to the declared Temu Global product-management purpose. In a skill expected to manage Temu products, hidden account bootstrap and billing logic materially expands the privilege and data exposure surface and may cause users or hosts to disclose credentials or perform purchases they did not intend.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create paid orders and render payment QR codes, which is a billing capability unrelated to Temu product listing or inventory management. In this skill context, such functionality is especially dangerous because it enables unexpected financial actions from a seemingly unrelated integration, increasing the risk of deceptive purchases or misuse of authenticated accounts.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The file performs SMS login, token-based account login, team lookup, and API token retrieval/generation for LinkFox accounts, all outside the declared scope of Temu product management. In this context, the behavior is more dangerous because it can solicit verification codes and mint reusable API credentials under the guise of a product-management skill.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This script introduces credential persistence functionality by accepting a raw Temu access token and saving it for later reuse, which goes beyond the declared product-management scope of the skill. Expanding a skill from product operations into token storage increases the attack surface and creates a reusable secret at rest that could be abused by other components or users if local storage is accessed improperly.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code persists an access token to a local token store without demonstrating safeguards such as encryption, narrowing of token scope, expiration enforcement, or authorization checks around later retrieval. Because this is a product-management skill rather than a credential-management skill, the presence of local secret storage is especially risky: compromise of the host, workspace, or adjacent tooling could expose a reusable bearer token and enable unauthorized API actions.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill instructs that complete API responses must always be written to local session-scoped files, and those responses may contain access tokens, account identifiers, inventory data, or other sensitive business information. Persistent local storage of full responses increases the blast radius of compromise, creates unnecessary retention of secrets, and may expose data to other tools, users, or later sessions on the same workspace.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Persisting complete API responses and emitting human-readable summaries creates a durable data-retention channel that can expose sensitive payloads to local users, logs, backups, or later tooling. Because the data is also summarized in natural language, sensitive fields may become easier to spot and leak even when operators do not inspect the raw JSON file.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/temu_proxy.py:7