Back to skill

Security audit

Temu全球站-订单

Security checks across malware telemetry and agentic risk

Overview

This skill should be reviewed because it handles Temu order data and credentials while exposing broad proxy, onboarding/payment, and persistent storage behavior beyond a tightly scoped Global order API.

Install only if you trust LinkFox with Temu order, shipping, and credential data. Use it in a controlled workspace, avoid setting gateway override environment variables except to known LinkFox endpoints, protect or disable the local token store where possible, and treat saved response files as sensitive customer/order records. Do not use the generic proxy, token-printing, onboarding, or payment commands unless you explicitly intend those broader actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (40)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
86% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
88% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill uses environment variables, writes files, and makes network requests, but does not declare permissions or boundaries for those capabilities. That makes the operational trust model opaque and increases the risk of over-privileged execution, especially because the skill handles API keys, access tokens, and order data.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is a narrow wrapper for 9 global order APIs, but the skill also exposes generic proxying, file download, local token persistence, onboarding/account flows, and multi-site capabilities. This mismatch is dangerous because users and calling agents may grant trust or provide secrets under a narrower assumption while the skill can perform broader actions than expected.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The document says requests have a cost and should not be retried casually, but later states that the skill does not consume points. Contradictory billing guidance can cause unsafe automation behavior, unexpected spend, and poor operator decisions during failure handling.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill claims to cover only 9 global order endpoints, but later includes local token storage and generic multi-site gateway tooling. Hidden expansion of scope increases the chance that sensitive credentials or data are used in contexts the user did not intend and weakens least-privilege assumptions.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The helper writes complete API responses to local files regardless of response sensitivity, which expands the skill from simple API forwarding into local data retention. For order-management APIs, responses can contain customer/order data, shipment details, and possibly tokens or identifiers, so persistent storage increases exposure if the host is shared, compromised, or logs are later accessed.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code creates a reusable session root and index structure under local directories, enabling accumulation of API outputs across sessions. That creates a broader archival capability than the stated order API forwarding role and increases the blast radius of any local compromise because historical order data may be discoverable in one place.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script is a generic token retrieval utility that accepts arbitrary site, managementType, and tokenPurpose values, which exceeds the skill's stated order-global API-forwarding scope. In this context, that broad credential access increases the chance of privilege misuse or accidental cross-scope token exposure, especially because the tool is packaged with an order-management skill rather than a dedicated credential-admin workflow.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The script directly extracts a stored Temu access token and returns it in plaintext JSON, giving callers raw reusable credentials instead of performing the intended API action through a controlled gateway. That creates a high-risk secret exfiltration path: any component or user able to invoke the script can potentially reuse the token outside the skill, bypassing audit and scope controls.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements account onboarding, SMS login, API-key issuance, package purchase, and payment QR generation, which is materially outside the advertised Temu Global order-management scope. Scope divergence is dangerous because users and reviewers may grant the skill permissions or trust appropriate for order operations while hidden or unrelated monetization/account functions handle credentials and payments.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code can retrieve or generate LinkFox API tokens after SMS-based login, effectively minting reusable credentials from within a skill whose stated purpose is unrelated to account provisioning. In context, this dramatically increases danger because compromise, misuse, or social engineering through the skill can turn a one-time login flow into persistent account access.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The package listing, order creation, and payment QR rendering logic enables purchase of LinkFox plans, which is unrelated to Temu order management. In a mismatched skill context, billing functionality can be abused to trigger unexpected purchases or manipulate users into payment flows they did not intend when invoking a Temu operational tool.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The module openly describes itself as a LinkFox onboarding CLI rather than a Temu Global order-management component, confirming a manifest-to-code mismatch. While not an exploit primitive by itself, this inconsistency is a strong trust and review evasion issue because it indicates the shipped behavior is broader than what users and operators would expect from the skill metadata.

Description-Behavior Mismatch

High
Confidence
92% confidence
Finding
The script persists arbitrary Temu access tokens based on caller-supplied site, managementType, and tokenPurpose values, which extends beyond the skill’s declared order-global scope. In an agent environment, this creates a reusable credential store that could retain broader-scope tokens for other Temu domains, enabling unauthorized follow-on access if the store is abused or read by other components.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
This file adds credential persistence functionality even though the stated skill purpose is order API proxying, increasing the attack surface with a secret-management capability not clearly required for the advertised behavior. In practice, storing tokens locally can outlive the user’s immediate action and permit later API use without fresh user consent, especially if other scripts can reference the same storeKey.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
This script exposes a signed file-download capability that is not reflected in the skill’s declared order-management scope. Scope drift is dangerous because users, reviewers, or policy controls may authorize the skill for order APIs while it can also fetch arbitrary Temu-signed resources, increasing the chance of unintended data access or exfiltration if invoked with attacker-chosen URLs.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The module documentation advertises US-site usage even though the skill metadata says this skill is for Global (non-US/EU) orders. This mismatch can cause operators or orchestrators to route requests to the wrong regional environment, potentially bypassing intended skill segmentation and enabling unauthorized data handling across regions.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The script is a generic Temu proxy that forwards caller-controlled API type and parameters, while the skill metadata claims a narrowly scoped global order-management integration. That mismatch enables capability expansion beyond the declared trust boundary, potentially letting a user invoke unrelated Temu APIs through the skill if backend validation is weak or absent.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The code accepts a caller-supplied site value via validate_site(require_text(params, "site")) instead of enforcing the manifest's declared default/scope of global. This can allow cross-region access or unintended routing to other Temu environments, weakening the skill's advertised restriction and increasing the chance of unauthorized or unexpected data access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill supports decrypting shipping information and the broader document says full responses are always stored locally, yet there is no strong privacy warning or handling guidance for PII. That creates a real risk of exposing names, addresses, phone numbers, or other sensitive fulfillment data through disk persistence, logs, and stdout.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation explicitly recommends saving a Temu access token to a local file but does not warn that this token is a sensitive credential granting API access. Without guidance on file permissions, encryption, avoiding commits/backups, or secret-handling practices, users may store long-lived tokens in insecure locations where local compromise, shared accounts, or accidental disclosure can expose store order and shipping operations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation explicitly advertises an endpoint to retrieve decrypted shipping address data, which is highly sensitive personal information, but it provides no privacy warning, access-scoping guidance, masking requirement, or use-limitation controls. In an agent skill context, this increases the chance that downstream automation or users will request, expose, log, or mishandle full recipient PII beyond what is necessary for order fulfillment.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The document explicitly describes a workflow that retrieves parent order identifiers and then uses shipping-info/decryption APIs to obtain customer address data, but it provides no warning, minimization guidance, or access-control expectations for handling sensitive order/customer information. In an agent skill context, this can normalize over-collection or unnecessary disclosure of personal data and increase the chance that downstream automation exposes decrypted shipping details to users or logs.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This documentation enables bulk retrieval of personalized order content, including user-provided text, uploaded images, and downloadable SVG/compressed files, which can contain sensitive personal data. It also describes how to authenticate direct file downloads via TOA headers, but provides no warning, minimization guidance, access-control expectations, or handling requirements for potentially sensitive customer content.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.