Temu欧洲站-订单

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:42 AM UTC
• Version: 1.0.5

Overview

This skill mostly does the advertised Temu EU order work, but it also stores sensitive tokens and full order responses locally and exposes broader gateway/onboarding/payment capabilities that need review before installation.

Review before installing. Use it only in a trusted workspace, with least-privilege Temu and LinkFox credentials, and expect full API responses and optional Temu tokens to be written locally. Avoid using the generic proxy or raw token listing unless you deliberately need those capabilities, and delete or protect the generated linkfox data and token-store files after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes environment-variable access, network access, and local file writes, but does not declare permissions or boundaries for those capabilities. In a security review context, this is dangerous because the skill handles order data and tokens, so undeclared capabilities reduce transparency and make it easier to over-collect secrets or persist sensitive data without operator awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior significantly exceeds the advertised scope of an EU order-management wrapper by including onboarding, API key handling, payment/order-plan flows, token storage, generic multi-site proxying, and file-download utilities. This mismatch is dangerous because users may trust the skill for a narrow purpose while it actually enables broader account, token, and payment-related operations that expand attack surface and increase the chance of misuse or credential exposure.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: A skill presented as order-management-only also documents local storage, retrieval, and listing of Temu access tokens. Persisting and exposing token-management functionality inside a broader operational skill increases credential-handling risk and can lead to unauthorized reuse, accidental disclosure, or lateral misuse by anyone with local access.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill claims EU-only order scope, yet documents generic multi-site proxy and signed file-download scripts. That broadens the reachable API surface beyond the stated trust boundary, making it easier to invoke unintended endpoints or process data from other domains without users realizing the skill is not actually constrained to EU order operations.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The shared helper automatically serializes and writes full API responses to local disk for every call, and this skill handles order-management data that can include addresses, order details, pricing, and verification-related identifiers such as SN/IMEI. Persisting complete responses outside the primary API transaction creates unnecessary at-rest copies of sensitive commerce data and increases exposure if the host, workspace, or temp directory is accessible to other users, tools, or sessions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code builds a reusable cross-session archive under shared locations and appends an index of outputs, which broadens the blast radius beyond a single invocation. For an order API proxy, creating a durable multi-session dataset of prior responses is not necessary for core functionality and can enable later discovery, aggregation, or misuse of sensitive business and customer information.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This script enumerates locally stored Temu access tokens and explicitly supports disabling masking via a user-controlled parameter, which enables direct secret disclosure. For an order-management skill, exposing bearer tokens is unnecessary to core functionality and materially increases the risk of account takeover, unauthorized API use, and downstream data exposure if the script is invoked by an operator, another tool, or an attacker with local access.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key generation, plan purchase, and payment QR creation, which is unrelated to the declared Temu EU order-management scope. Such scope divergence is dangerous because it can trick users into disclosing phone numbers, SMS codes, and credentials or initiating payments under the guise of a different business function.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The core behavior in this section centers on listing subscription plans, creating orders, and generating payment QR codes for LinkFox services rather than handling Temu EU partner orders. In the context of a Temu order-management skill, this mismatch materially increases phishing and unauthorized billing risk because users may trust the skill to perform order operations while it instead drives account monetization flows.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The proxy forwards a user-supplied 'type' field directly to the Temu gateway without restricting it to the EU order-management operations described in the skill manifest. This creates a scope-bypass capability: anyone invoking the skill can reach arbitrary Temu API methods through the skill's credentials/token handling path, potentially accessing unrelated product, pricing, fulfillment, or other sensitive operations.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The embedded usage example demonstrates CN product-category mapping through a skill that is advertised as handling EU order management. This mismatch is not just documentation drift; it reinforces that the implementation is a generic cross-domain proxy and may mislead reviewers or users into believing the skill is constrained when it is not, increasing the likelihood of unauthorized or unintended API use.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs writing complete API responses to disk by default, but does not warn that order, address, and shipping responses may contain highly sensitive personal and operational data. This omission is dangerous because users may unknowingly create local caches of PII and transactional data in project directories, increasing exposure through backups, source control, shared workspaces, or endpoint compromise.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly exposes an API for retrieving decrypted sensitive shipping address data, but it does not include any privacy warning, access-control guidance, data-minimization requirements, or handling restrictions. In an order-management skill, access to recipient PII may be operationally necessary, but documenting decryption of address data without safeguards increases the risk of misuse, overcollection, and accidental disclosure.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation exposes an API flow for bulk retrieval of customized order content, including customer-provided text, images, SVG data, and downloadable compressed files, but it provides no warning about sensitive or user-supplied content handling. In an order-management context, these artifacts can contain personal data, unsafe files, or malicious SVG/image payloads, increasing the risk of privacy leakage, unsafe downstream rendering, or insecure operator handling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This documentation exposes an API specifically intended to retrieve highly sensitive personal data, including recipient name, phone numbers, email, and full shipping address, but it provides no privacy warning, data minimization guidance, access-control expectations, or handling restrictions. In the context of an agent skill, that omission increases the risk that downstream agents or users will request, display, log, or retain personal data more broadly than necessary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly instructs users to upload highly sensitive device identifiers such as SNs and IMEIs, but it provides no warning about their privacy sensitivity, retention, masking, logging, or access-control requirements. In this skill context, that omission is material because the API is specifically for order operations and may cause operators or downstream tooling to treat these identifiers like ordinary order metadata, increasing the risk of over-collection, insecure handling, or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to manually copy an access token from the seller backend and optionally save it locally, but it does not state that the token is a secret or provide any handling safeguards. In a workflow for order-management APIs, such a token likely grants access to sensitive merchant and customer order data, so unclear guidance increases the risk of accidental disclosure, insecure local storage, reuse in the wrong context, or leakage through screenshots, chat logs, or files.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The onboarding instructions direct collection of a user's phone number and use it to trigger registration/login flows, but they provide no privacy notice, consent guidance, retention limits, or handling constraints. In an agent setting, this creates unnecessary exposure of personal data and increases the risk of mishandling or over-collection during support interactions.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The catalog explicitly exposes capabilities for decrypting shipping information and uploading SN/IMEI-style verification data, but provides no handling guidance, minimization requirements, or warning that these operations involve sensitive personal and device-linked data. In an order-management skill, this omission increases the chance that downstream prompts, logs, or operators will request, display, or persist regulated data more broadly than necessary.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide explicitly instructs users to copy an access_token and save it via another script, but it does not warn that the token is a sensitive credential or provide any secure-storage expectations. In an order-management skill context, these tokens likely grant access to seller order, shipping, and potentially PII-related operations, so omission of storage and handling safeguards materially increases the chance of credential leakage through logs, plaintext files, or unsafe sharing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper saves API responses automatically and prints the save path, but there is no prior disclosure or consent mechanism warning that potentially sensitive order data will be persisted locally. This is dangerous because users may reasonably expect a transient proxy action while the implementation silently creates durable local copies of sensitive responses.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code persists Temu access tokens in plaintext JSON on the local filesystem and does not set restrictive file permissions or use an OS-backed secret store. In an agent skill handling order-management APIs, compromise of this file could let another local user, process, backup system, or malware reuse the bearer token to access sensitive seller order data and perform authenticated actions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script emits the retrieved access token directly to stdout in JSON. In agent, CI/CD, logging, shell history, or tool-chaining environments, stdout is commonly captured, persisted, or exposed to downstream components, which can leak valid credentials and enable unauthorized API access.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.