Temu美国站-订单

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:36 AM UTC
• Version: 1.0.5

Overview

This skill performs Temu order operations, but it also includes broad proxy, billing/onboarding, and plaintext local secret and response storage behaviors that should be reviewed before installation.

Review this skill before installing. Use it only if you intend to let LinkFox handle Temu order and customer data, avoid setting gateway or login endpoint override environment variables unless they point to trusted LinkFox infrastructure, and be aware it stores Temu tokens and full API responses locally. Treat onboarding and payment commands as explicit user-approved actions, and avoid the generic proxy for non-order APIs unless that broader authority is intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents use of environment variables, network access, and persistent file writes, yet declares no permissions. This weakens transparency and policy enforcement because users and hosting platforms cannot accurately assess that the skill can exfiltrate secrets, contact external services, and store potentially sensitive data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is US order management, but the documentation exposes materially broader capabilities: onboarding/login flows, payment and subscription purchase operations, token management, and a generic proxy that can reach arbitrary Temu API types. This scope expansion is dangerous because users may invoke privileged account, billing, or broader API actions they did not expect from the manifest, increasing the chance of credential misuse, unauthorized charges, or access beyond intended order operations.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: Including scripts to save, list, and retrieve Temu access tokens introduces local secret storage behavior that is outside the advertised order-management scope. Persisting and enumerating tokens locally raises credential exposure risk, especially in shared workspaces or repositories where files may be read by other tools or users.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper unconditionally serializes and writes full API responses to local disk, and this skill handles order data such as addresses, amounts, shipping, and verification artifacts. Persisting complete responses exceeds the stated API-proxy purpose and creates a local sensitive-data at-rest exposure that can be accessed by other local users, later processes, backups, or forensic recovery.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This code builds a reusable cross-session archive under predictable directories (workspace/home/tmp), maintains session metadata and an index, and accumulates data files over time. For an order-management skill, that creates an unnecessary long-lived local repository of potentially sensitive order and customer data, increasing blast radius well beyond a single request.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key retrieval, plan purchase, and payment handling, which is materially unrelated to the declared Temu US order-management skill. Scope divergence is dangerous because users or reviewers may grant trust based on Temu-order functionality while the code actually performs account bootstrap and monetization actions against another service. That mismatch raises the likelihood of unauthorized credential collection and unintended purchases.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can fetch or generate LinkFox API tokens for a group, creating a new privileged credential inside a skill whose stated purpose is Temu US order management. Unnecessary token-minting capability expands blast radius: compromise or misuse of this skill can yield reusable credentials beyond the immediate task. In context, this is more suspicious because the functionality is orthogonal to the advertised business purpose.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file creates purchasable LinkFox package orders and renders payment QR codes, which has no clear connection to Temu US order management. This enables real financial actions from within a mis-scoped skill and could lead to unauthorized or unexpected charges if triggered by users or agents who believe they are only managing Temu orders. The context makes this more dangerous because payment operations are hidden behind a misleading skill description.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The code writes QR payment images and session artifacts to local directories under workspace, home, or temp paths, even though the skill is presented as an API wrapper for Temu order operations. Persisting these artifacts can leak payment links, operational metadata, or user activity to other local processes or later sessions, especially in shared environments. The mismatch in scope also suggests users may not expect filesystem side effects.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The script introduces credential persistence functionality that is not reflected in the skill's declared order-management scope. In an agent skill, hidden or under-declared token handling broadens the trust boundary and can enable reuse of long-lived Temu credentials for actions beyond the user's immediate request if the local store is later accessed by other components or users.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The call to save_token persists a sensitive access token locally without any visible safeguards in this file, creating a reusable credential cache. If the local token store is readable by other processes, users, logs, backups, or later agent actions, an attacker could impersonate the linked Temu store and perform unauthorized API operations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module advertises and implements a generic Temu API proxy, which exceeds the declared skill scope of US order-management operations. In an agent ecosystem, this kind of scope mismatch is dangerous because downstream policy may trust the manifest description while the code can be used to invoke broader Temu capabilities, enabling unauthorized actions or data access outside the intended order domain.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code accepts an arbitrary user-supplied `type` value and forwards it to the backend proxy without validating that it belongs to the manifest-approved order-management operations. This creates a confused-deputy/capability-expansion issue where callers can route non-order APIs through a skill that appears limited, potentially performing unintended Temu actions or reaching unrelated data and account functions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill handles sensitive order information, including shipping details and decrypted address data, but does not clearly warn users about the privacy implications of retrieving and persisting that information. In this context, omission matters because users may unintentionally expose personal data through logs, local files, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document tells users to persist Temu access tokens locally and even shows example commands containing raw tokens, but it does not clearly warn that these are sensitive credentials requiring secure storage, restricted file permissions, and avoidance of shell history/log exposure. In a skill centered on order management APIs, leaked tokens could allow unauthorized access to order data and operational actions such as shipment or verification-related API calls.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly advertises an API that returns decrypted sensitive shipping address data but does not provide any privacy warning, access-control guidance, or usage restrictions. In an order-management skill, this increases the likelihood that downstream agents or users will retrieve and expose PII without validating business need, consent, logging, or redaction.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The README advertises an API specifically for decrypting shipping information, which strongly implies access to sensitive personal data such as recipient names, addresses, and phone numbers. In an order-management skill, omitting any warning, access-control expectations, or data-handling guidance increases the risk that downstream users or agents will retrieve and expose PII without appropriate safeguards.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This documentation exposes an API for bulk retrieval of user-customized order content, including free-form text, images, SVGs, and downloadable compressed files, but does not warn that these materials may contain sensitive personal data or untrusted user-supplied content. In an agent skill context, that omission can lead downstream consumers to fetch, display, log, or further process attacker-controlled or privacy-sensitive data without appropriate safeguards.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This documentation explicitly exposes an API that retrieves highly sensitive personal data including full shipping address, recipient name, phone numbers, and email, but it provides no warning, data-handling constraints, masking guidance, or access-control expectations. In an agent skill context, this increases the chance that downstream users or automations will request, display, log, or persist unnecessary PII, leading to privacy violations or unauthorized disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document tells users to copy a Temu access token from the seller backend and optionally persist it in a local store, but it does not include any safeguards for secret handling, storage protection, redaction, expiration, or least-privilege use. In the context of an order-management skill that can access order details, addresses, shipment flows, and verification uploads, mishandling this token could enable unauthorized API access and exposure or modification of sensitive business and customer data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The onboarding flow instructs the operator to collect and process a user's phone number for scripted registration, but it does not require an explicit user-facing consent, privacy notice, or data-handling warning before doing so. This creates a real privacy and compliance risk because personal data is being solicited and used in an automated registration process without clear informed consent or minimization guidance.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Access tokens are stored in plaintext JSON on disk with no encryption, permission hardening, or user warning about persistence. If the host is multi-user, backed up insecurely, or compromised by other local processes, these tokens can be read and reused to access Temu order data and perform authenticated operations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script prints the retrieved access token directly to stdout in JSON output, which can expose the credential to terminal history, logs, calling processes, CI job output, or other monitoring layers. In this skill context, the token grants access to Temu-related APIs, so unintended disclosure could enable unauthorized order or account operations depending on the token scope.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.