Temu美国站-定价

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:47 PM UTC
• Version: 1.0.6

Overview

This appears to be a real LinkFox Temu pricing skill, but it grants and persists broader credential, proxy, file-download, response-storage, onboarding, and payment-order capabilities than a narrow US price-management tool needs.

Install only if you need LinkFox-mediated Temu operations and are comfortable with a broad gateway helper. Use a dedicated workspace, keep LINKFOX_* gateway variables pointed only at trusted LinkFox hosts, avoid passing real tokens on command lines, protect or relocate the plaintext token store, delete saved response files when no longer needed, and treat onboarding or payment-order commands as explicit account/billing actions requiring user confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, API keys, and team identifiers to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication and onboarding traffic to an attacker-controlled server and exfiltrate credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request path uses a URL derived from environment variables and attaches the LinkFox API key in the Authorization header before calling urlopen. A poisoned runtime environment could redirect these requests to an external host and leak the API key or cause unauthorized order/account actions through a rogue endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents capabilities to read environment variables, write files, and make network requests, but does not declare permissions or clearly scope those powers. Hidden or undeclared capability expansion increases the chance that operators invoke the skill without understanding that it can access secrets, persist data locally, and transmit data externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a narrow Temu US price-management wrapper, but the documented behavior extends into account onboarding, login/API-key lifecycle, payment flows, generic proxying, signed file download, and local token storage. This mismatch is dangerous because users may trust the skill in a limited context while it actually exposes broader credential, billing, and arbitrary API-access surfaces that materially raise abuse and data-exposure risk.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script retrieves a stored Temu access token and prints it in raw form to stdout, making credential disclosure trivial to any caller, log collector, shell history capture, or upstream tool invoking the script. In the context of a price-management skill, exposing the bearer token is broader than necessary because the token can likely be reused for additional API actions beyond the immediate operation, increasing the blast radius of compromise.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS login, API-key issuance, package browsing, order creation, and payment handling, which are unrelated to the declared Temu US price-management skill. That scope mismatch is dangerous because it introduces credential collection and billing capabilities users would not reasonably expect from a pricing integration.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can create paid orders and generate QR codes for payment, enabling direct billing actions from within a skill that is supposed to manage Temu pricing. In this context, hidden monetization capability is especially risky because it could trigger unauthorized purchases or socially engineer users into paying for unrelated services.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file sends SMS verification codes, logs users in, retrieves team information, and obtains or generates LinkFox API tokens, all outside the stated Temu pricing purpose. In a mismatched skill, this behavior effectively acts as credential and account bootstrap tooling, increasing the risk of unauthorized account access and token harvesting.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This script adds persistent access-token storage capability to a skill घोषित as a Temu US price-management API wrapper, which materially expands its privilege and data-handling scope. Storing reusable bearer tokens locally creates a credential theft and misuse risk if the host, logs, filesystem, or adjacent tools are compromised, and the mismatch between declared scope and implemented behavior makes the capability harder for users and reviewers to anticipate.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code explicitly accepts an access token from the command line and saves it for later reuse, implementing persistent credential handling unrelated to the stated price-query/change purpose. Command-line token ingestion also increases exposure because secrets may be captured in shell history, process listings, audit logs, or terminal recordings before they are even written to storage.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This script exposes a generic signed-file download capability through the skill even though the manifest describes the skill as limited to Temu US price-management operations. Scope drift like this is dangerous because it can let users invoke unrelated data-access functionality, potentially retrieving signed resources or sensitive files via the gateway with the skill's credentials or trust boundary. The surrounding skill context makes this more suspicious, not less, because file download is not necessary for price-order querying or SKU price changes.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements and documents a generic Temu API proxy that forwards arbitrary API 'type' values and caller-supplied parameters, while the skill metadata says the skill is only for Temu US price-management operations. That mismatch creates a scope-bypass primitive: a user can invoke unrelated Temu APIs through this skill, potentially reaching broader product, category, or account functionality than intended.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The request builder accepts a caller-provided 'site' and only validates that it is syntactically acceptable, not that it is limited to the US site promised by the skill description. This allows cross-region use of the same proxy and undermines the trust boundary established by the manifest, expanding the reachable business surface beyond the approved US pricing context.

Intent-Code Divergence

High

• Confidence: 91% confidence
• Finding: The module docstring and usage example advertise a general-purpose '/temu/proxy' forwarder and demonstrate a non-price API ('bg.goods.category.mapping'), directly contradicting the manifest's narrow Temu US pricing purpose. This is dangerous because it signals and enables broader operational use, increasing the likelihood that agents or users will invoke unauthorized API families through the skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This script exposes a generic file-download capability by accepting an arbitrary URL and forwarding it to a backend download endpoint, but the skill’s declared purpose is Temu US price management. That scope mismatch is dangerous because it can enable unintended data access or retrieval of remote content through the gateway, especially if upstream validation is weak or if the access token has broader privileges than expected.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that full API responses are automatically persisted locally by default, but it does not present an explicit user warning about sensitive-data retention. Because these responses may contain business data, identifiers, pricing details, or even user-supplied secrets echoed by upstream systems, silent persistence increases the risk of unintended disclosure to other local users, tools, backups, or logs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs users to persist a Temu access token locally and even includes example commands with a pasted token value, but it does not warn that this credential is sensitive, should be protected at rest, and may grant access to business APIs if exposed. In an agent skill context, users may follow these steps verbatim on shared machines or insecure environments, increasing the chance of credential leakage through files, shell history, backups, or improper file permissions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly instructs the user to copy a Temu access token from the seller backend and optionally save it locally, but provides no warning that the token is a sensitive credential or guidance for secure storage and transmission. In this skill context, the token grants API access to store operations, so mishandling could enable unauthorized access, price changes, order access, or other account actions through the gateway tools.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The instructions direct the operator to collect a user's phone number and submit it to an external onboarding flow to register or log in, but they do not require explicit user consent, data-minimization, or a privacy notice. In an agent workflow, this can lead to unnecessary collection and transmission of personal data and increases the risk of privacy violations or mishandling of account-linked credentials.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The markdown recommends shell commands that permanently modify user environment configuration files such as ~/.zshrc and ~/.bashrc, and also invokes source to apply changes immediately, without a clear warning about persistence or rollback steps. In a support skill, this creates avoidable system-impacting changes and can cause accidental misconfiguration or encourage users to run sensitive commands they do not fully understand.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide explicitly tells users to copy and save an access_token but does not clearly warn that the token is a sensitive credential equivalent to account/API access. In this skill context, that omission is more dangerous because the file is an authorization guide for marketplace seller accounts, so users may paste or store tokens insecurely and enable unauthorized API access if the token is exposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script emits the full access token in JSON without any warning, masking, or output-channel protection. Secrets printed to standard output are commonly captured by terminal scrollback, CI logs, agent transcripts, telemetry, and calling processes, so a single invocation can unintentionally leak reusable authentication credentials.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The usage text instructs users to paste a live access token into a JSON command argument without any warning that the token may persist in shell history or local storage. Even if token storage is intentional, the absence of user-facing notice materially increases the likelihood of accidental credential disclosure and unsafe operational handling.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Always saving complete API responses to session-organized local files creates a standing data-at-rest exposure, especially when responses may include tokens, access credentials, pricing information, or other sensitive user data. In a shared workstation, CI agent, or multi-tool environment, those files can be discovered, indexed, exfiltrated, or retained far longer than intended.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The helper unconditionally persists full API responses to disk under predictable session directories and also prints summaries that may include sampled record contents. In this skill context, responses can contain Temu business data, pricing records, store identifiers, and possibly tokens or other sensitive fields returned by the gateway, creating unnecessary retention and local exposure risk if the filesystem, temp directory, or logs are accessible to other users/processes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.