Temu欧洲站-定价

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:37 AM UTC
• Version: 1.0.5

Overview

This skill mainly supports Temu EU pricing, but it also stores credentials locally and exposes broader account, billing, proxy, and file-download capabilities that need review before installation.

Install only if you intend this agent to manage live Temu pricing through LinkFox and are comfortable with local token storage. Use a least-privilege Temu token, protect or avoid the ~/.linkfox token file, confirm every batch price change, avoid generic proxy/file-download/payment helpers unless needed, and only use trusted LinkFox gateway endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 91% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises and documents access to environment variables, local file writes, and network operations, but declares no explicit permissions boundary. In an agent setting, this creates a capability-transparency problem: users and policy systems may not realize the skill can read secrets, persist sensitive data, and call external services, increasing the chance of over-privileged execution or unsafe invocation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a Temu EU price-management tool, but the documentation shows materially broader behavior: account onboarding, API-key lifecycle actions, payment/order flows, generic proxying, generic file download, and local token management. That mismatch weakens user consent and policy enforcement because an operator may invoke a seemingly narrow skill that can perform much broader sensitive actions than expected.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The helper unconditionally persists full API responses to local files, which expands the skill's behavior beyond making price-management API calls into local data retention. Those responses may contain store identifiers, pricing data, tokens, or account-related metadata, creating unnecessary exposure if the host is shared, compromised, or logs are later inspected.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: This code builds a local session archive and indexing system that is unrelated to the stated EU pricing purpose and enables accumulation of operational data across runs. Even if intended for convenience, hidden archival behavior increases the attack surface by creating discoverable historical records under predictable directories.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This script exposes a local capability to enumerate saved Temu access tokens, which is unrelated to the stated EU price-management function of the skill. Even though tokens are masked by default, the optional `mask: false` path allows direct credential disclosure, creating a clear avenue for credential harvesting or lateral misuse if the script is invoked by an agent or local user.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API key issuance, package purchasing, and payment workflows, which are unrelated to the declared Temu EU price-management capability. Such scope expansion is dangerous because users invoking a pricing skill may be induced to disclose phone numbers, verification codes, or authorize billing actions outside the skill's stated purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code contains plan listing, order creation, and QR-code payment rendering, enabling direct billing actions unrelated to Temu EU price management. In this context, payment capability is especially risky because it can trigger purchases or social-engineer users into completing payments under the guise of a product-pricing tool.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file performs SMS-based account login, team selection, and API-token retrieval/generation for LinkFox accounts even though the skill is supposed to manage Temu EU pricing. This creates an unjustified credential-collection and token-minting surface, increasing the chance of account takeover, unauthorized API access, or abuse of user trust.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The script provides persistent credential storage by accepting a raw access token and passing it to save_token for local reuse, but there is no visible restriction, encryption, or storage-safety control in this file. In an agent skill focused on EU price management, adding generic local credential persistence increases the blast radius if the host, logs, or local store are exposed, and it expands capability beyond the narrowly stated business function.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This script exposes a file-download capability via eu_file_download_call even though the skill manifest describes only Temu EU price-management operations such as price-order query and SKU price changes. Scope mismatch is security-relevant because it creates hidden functionality that may be invoked to retrieve arbitrary remote files or sensitive exports through the gateway, expanding data-access beyond what users and reviewers expect.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This script exposes a signed file download capability even though the skill metadata describes an EU price-management function set, not generic file retrieval. Scope mismatch is dangerous because it can silently expand the agent’s authority to fetch arbitrary signed URLs or sensitive exports through the LinkFox/Temu gateway, creating an exfiltration or unauthorized data-access path that users and reviewers would not reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code accepts a user-provided URL and forwards it to a file-download API without any visible restriction tying the operation to EU price management. In the context of a pricing skill, this makes the capability more suspicious because signed URLs often grant temporary access to private files, so misuse could retrieve sensitive documents unrelated to pricing workflows.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script forwards arbitrary Temu API types and arbitrary params through a generic proxy, while the skill is described as limited to Temu EU price-management operations. In an agent setting, this scope mismatch can let a user invoke unrelated privileged Temu APIs through the skill, bypassing intended capability boundaries and enabling unauthorized actions outside pricing workflows.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The code accepts a caller-supplied site value via validate_site(require_text(params, "site")) and does not enforce site=eu, despite the skill being positioned as a Temu Europe pricing skill. This allows use against non-EU environments, expanding the blast radius of the skill and undermining policy or business controls that depend on regional separation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that every full API response is always written to local files, but does not clearly warn users that these responses may contain access tokens, pricing data, account identifiers, or other sensitive content. Persistent local logging expands the exposure window beyond the immediate task and can leak data to other local users, later processes, backups, or accidental commits.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly recommends storing a Temu access token locally in a predictable file path, but it does not warn users to protect that file with restrictive permissions, encryption, or other safeguards. Because this token authorizes business API access, local disclosure through multi-user systems, backups, logs, shell history, or malware could lead to unauthorized access to store data and operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation describes a high-impact batch price-change operation that can modify multiple SKU base prices but does not prominently warn about the business consequences, approval requirements, or the need for explicit user confirmation before execution. In an agent skill context, such omissions increase the chance that an automated workflow will perform unintended or unauthorized price changes, causing financial loss, listing disruption, or merchant-side operational issues.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The documentation gives EU-specific guidance that recommends US units (`weightUnit=lb`, `dimensionUnit=inch`) without clear justification or user choice. In a pricing/recommendation API that uses product dimensions and weight as pricing inputs, this can cause systematically incorrect estimates, downstream pricing mistakes, and business logic errors if users follow the documented defaults blindly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs users to copy a Temu access token from the seller backend and optionally save it locally, but it does not state that the token is a sensitive credential or warn about the risks of persistence. In this skill context, the token appears sufficient to authorize downstream API calls for store operations, so unclear handling guidance increases the chance of credential leakage, accidental reuse, or insecure storage.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The onboarding trigger conditions are broad enough to activate on generic authentication or billing-related error text, even when the error may originate from a different subsystem or skill. This can cause the agent to inappropriately steer users into account recovery, registration, or payment flows, increasing the chance of credential mishandling, privacy exposure, or unintended purchases.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide explicitly tells users to manually copy an access token and save it for later API use, but does not clearly label the token as a sensitive secret or warn against insecure storage, logging, or sharing. In an agent skill context, operational guidance that normalizes handling bearer tokens like ordinary data increases the chance of credential leakage and unauthorized API access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: These workflow steps instruct users to select broad permissions and then copy the resulting access token, but provide no warning about the security consequences of granting excessive privileges or mishandling the token. A leaked high-privilege token could enable unauthorized order, product, inventory, or pricing actions through the gateway, which is more concerning because this skill is specifically designed to facilitate production API operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Full API responses are written to disk without any user-facing warning or consent flow, which can silently persist sensitive Temu or LinkFox account data locally. In a skill context that handles commerce APIs and authentication material, silent persistence materially increases confidentiality risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.