Temu美国站-商品管理

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:51 PM UTC
• Version: 1.0.6

Overview

This appears to be a real Temu product-management integration, but it bundles broad account, billing, token, and local-storage behavior that users should review carefully before installing.

Review this skill before installing if you manage real Temu stores. Use it only on trusted machines, avoid pasting long-lived tokens into shared prompts or logs, protect or relocate the local token store, periodically delete saved linkfox response archives, and require your agent or operator workflow to confirm exact store/site/goodsId/SKU details before any delete, full update, stock, sale-status, pre-sale, billing, or credential action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exposes environment-variable access, file writes, and outbound network use but does not declare permissions or present those capabilities transparently. This increases the chance that an invoking agent or user will authorize broader behavior than expected, especially because the skill also handles tokens and writes API responses to disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow product management, but the skill surface includes generic proxying, token storage/retrieval, onboarding, payment/plan handling, and file download capabilities. This scope expansion materially increases attack surface and can let prompts intended for harmless catalog operations trigger credential handling, broader API access, or account/billing actions outside user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The reference text says this skill covers '价格' in the relation table, while the manifest explicitly states pricing should be handled by a different skill. This scope drift can cause an agent to route price-changing requests to the wrong skill, weakening least-privilege boundaries and increasing the chance of unintended financial-impacting actions.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper persistently writes full API responses to local disk, and these responses can contain product data, store identifiers, compliance details, or embedded tokens returned by upstream services. For a product-management wrapper, indiscriminate archival exceeds the minimum necessary behavior and creates a secondary local data exposure surface if the workstation, temp directory, or shared home directory is accessed by other users or tools.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code creates a reusable cross-session archive under multiple fallback locations including the user's home directory and system temp directory. This expands data retention beyond a single API call and can silently accumulate sensitive operational data across sessions, making later discovery or unauthorized local access more damaging.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The metadata functions create and update a session manifest and append entries to a global index.jsonl, building a discoverable catalog of historical activity. Even without full payload contents, this exposes session IDs, dates, skills used, and file paths, which can help an attacker or another local process enumerate and target stored sensitive records.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This script enumerates locally stored Temu access tokens, which are authentication secrets unrelated to the stated product-management API behavior. Even though masking is enabled by default, the presence of a built-in path to reveal or inventory credentials expands secret exposure risk and creates an easy post-compromise or insider misuse primitive.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This file contains account package listing, order creation, and QR-code payment generation logic that is unrelated to a Temu US product-management skill. That scope mismatch is dangerous because a user invoking a marketplace-management skill would not reasonably expect billing and purchase flows, creating a strong risk of unauthorized charges or deceptive monetization behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script performs SMS-based login, fetches user/team details, and obtains or generates API keys for LinkFox accounts, all outside the stated Temu manage-product purpose. In this context, collecting phone numbers, verification codes, and issuing long-lived API credentials is highly sensitive and can enable account takeover or unauthorized access if triggered under false pretenses.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This script introduces credential persistence behavior that is not described by the skill’s stated product-management API purpose. A utility that saves reusable access tokens locally expands the skill’s trust boundary and creates a new secret-storage capability that could be abused by other local code, leaked through filesystem exposure, or used beyond the user’s expected workflow.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code accepts a raw access token from input and stores it for later reuse, creating a durable credential cache. Persisting bearer tokens locally is dangerous because compromise of the host, logs, backups, or the token store can allow unauthorized API access with the same privileges as the original user or shop integration.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This script exposes a generic signed-file download capability via /temu/fileDownload, but the skill manifest describes a Manage Product scope focused on product CRUD, inventory, compliance, and related product-management APIs. Scope drift is dangerous because it can let the agent access or retrieve arbitrary signed resources not clearly covered by user expectations or least-privilege boundaries, increasing the chance of unauthorized data access or misuse of sensitive temporary URLs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises destructive operations such as delete, stock changes, and sale-status changes without requiring explicit warning or confirmation. In an agent setting, this raises the risk of accidental or prompt-induced destructive changes to live product listings and inventory.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates automatic persistence of complete API responses into the current project directory without a privacy or retention warning. Because these responses may contain account identifiers, product metadata, compliance details, and possibly sensitive operational data, this creates unnecessary local data exposure and cross-task leakage risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly recommends storing Temu access tokens on disk in a default local file and shows example commands that persist the secret, but it does not warn that these are sensitive credentials or describe file-permission, encryption, rotation, or workstation compromise risks. Because these tokens authorize business API actions such as product edits, inventory changes, and deletions, disclosure from local storage could let an attacker manipulate a merchant's catalog or operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation describes a state-changing API that edits remote product compliance records, including qualification files, responsible-person IDs, and governance attributes, but it does not clearly warn that use will modify live marketplace data. In an agent-skill context, missing confirmation and risk signaling can lead to unintended changes, accidental submission of incorrect compliance data, or unauthorized record updates if the skill is triggered loosely from user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The examples include an access token and transmission of compliance-related document URLs and identifiers without any caution about secrets handling or sensitive business/regulatory data. In practice, this can encourage unsafe logging, copying, or reuse of bearer tokens and expose compliance artifacts or IDs through prompts, transcripts, CI logs, or support channels.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This document describes a full product update API where complete product data and the full skuList must be submitted, but it does not prominently warn that omitted or stale fields may overwrite existing live catalog data. In a product-management skill, that omission is operationally dangerous because users or downstream agents may treat the request like a partial update and unintentionally destroy listings, images, attributes, or SKU configuration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation exposes a destructive product deletion capability but does not include any warning, confirmation guidance, or guardrails around irreversible or business-critical effects. In an agent skill context, omission of such safety cues increases the chance that an automated system or operator triggers deletion accidentally or without sufficient user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation exposes a state-changing product-management operation that can enable or disable SKU pre-sale status and alter pre-sale inventory/timing, but it does not warn that the action modifies live catalog state. In an agent skill context, missing mutation warnings and confirmation guidance increases the chance that an automated workflow or user triggers unintended changes to production listings, causing availability, merchandising, or customer-commitment issues.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The onboarding flow instructs the agent to collect a user's phone number and use it to trigger registration and login actions, but it provides no privacy notice, consent language, retention guidance, or restrictions on how that personal data should be handled. In an agent environment, this creates unnecessary exposure of sensitive personal data and can lead to improper collection, logging, or transmission of phone numbers and verification codes.

Missing User Warnings

High

• Confidence: 90% confidence
• Finding: The documentation exposes a product deletion capability (`temu.local.goods.delete`) without any explicit indication that deletion may be irreversible or should require strong confirmation. In an agentic environment, plainly advertising destructive operations without guardrails increases the risk of accidental or prompt-induced deletion of merchant inventory data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code repeatedly instructs users to copy an access token and save it via a script, but it does not clearly warn that the token is a sensitive secret or prescribe secure storage and handling. In the context of an API-management skill, this increases the chance that operators will paste tokens into logs, chats, source files, or insecure local storage, which could enable unauthorized access to Temu seller APIs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The helper announces that it saved the full response only after writing it, but there is no prior user-facing disclosure or consent mechanism for persistent local storage. This is dangerous because users may provide store tokens or retrieve sensitive product/compliance data without realizing the tool is creating durable local copies.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists Temu access tokens in plaintext JSON on local disk without setting restrictive file permissions, encryption, or any explicit safeguard around secret storage. In a commerce integration context, these tokens can grant direct access to product-management APIs, so compromise of the local filesystem, backups, or shared home directories could expose account access and enable unauthorized product changes or deletions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.