Temu商品查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.9

Overview

This Temu query skill is not clearly malicious, but it bundles sensitive login, API-key, billing, and response-storage behavior that users should review before installing.

Install only if you are comfortable sending Temu search data and session metadata to LinkFox, using LinkFox account credentials through the onboarding CLI, and storing full query responses locally. Treat SMS codes and generated API keys as secrets, confirm any plan or payment order manually, and avoid using environment-variable endpoint overrides unless you fully control them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: The POST destination is derived from environment-controlled base URLs and then used to send login, token, and user/account data over the network. In a skill/runtime environment, an attacker who can influence environment variables can redirect these requests to an attacker-controlled host and capture SMS login flows, access tokens, refresh tokens, group identifiers, and generated API keys.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 92% confidence
• Finding: The gateway URL is built from environment-controlled configuration and used by urllib with the Authorization header populated from the agent API key. If the runtime environment is tampered with, the skill can be coerced into sending its bearer token and account/order operations to an attacker-controlled server, enabling credential theft and fraudulent actions.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen includes tainted environment-derived values in both the destination selection path and outbound headers, notably LINKFOX_TOOL_GATEWAY, SESSION_ID, MODE_ID, APP_NAME, and the API key. If an attacker can influence environment variables, they can redirect requests to an attacker-controlled host and exfiltrate credentials and session metadata, making this a real SSRF/credential-leak issue rather than a generic network call.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises only a product-query function, yet static analysis detected environment access, file-write, and network-capable behavior without declaring permissions. Hidden or undeclared capabilities reduce transparency and can enable unexpected data exfiltration, local file modification, or outbound requests beyond the user's intent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a strong description-behavior mismatch: a Temu product search skill appears to also support SMS login, API key generation, account/team queries, plan listing, payment order creation, QR-code payment, and payment-status polling. Bundling authentication and billing operations into a shopping-query skill can mislead users into exposing credentials or authorizing purchases they did not expect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation adds a separate feedback-submission API that is outside the stated Temu product-query purpose of the skill. In an agent setting, this creates an unnecessary side-effecting capability that could be invoked without clear user intent, enabling unintended data exfiltration or outbound content submission to a third-party endpoint.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: A feedback submission capability is context-inappropriate for a read-oriented product query skill because it introduces a write channel unrelated to the user’s primary task. That mismatch increases the risk that an agent could be induced to transmit conversation-derived content externally under the guise of normal tool use.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements account onboarding, SMS authentication, API-key issuance, subscription listing, ordering, and payment QR generation, which is unrelated to the declared Temu product-query skill. Such scope mismatch is dangerous because it introduces hidden credential and payment functionality users and reviewers would not expect from a product-filtering tool.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill can create purchase orders and render payment QR codes despite being described as a Temu product-query/filter tool. Hidden payment capability materially increases abuse risk, including deceptive charges, unauthorized purchases, and trust-boundary violations in an agent environment.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs SMS-based login and API key acquisition for LinkFox accounts, which is unrelated to querying Temu products. This creates a covert credential-acquisition path that can be used to harvest or mint sensitive API access under the guise of an unrelated shopping skill.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger conditions are overly broad and may activate on general Temu-related shopping discussions, causing the skill to run when the user did not intend to invoke it. In the context of a skill that may also touch onboarding, API keys, or billing, over-triggering increases the chance of unnecessary data exposure, confusing consent boundaries, and unintended external requests.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs the agent to collect a user's phone number and use it to trigger registration and login flows, but it provides no consent language, retention limits, masking requirements, or warning that a one-time code is sensitive authentication data. In an agent context, this creates a real privacy and account-security risk because users may be induced to share personal data and verification codes without understanding how they will be handled.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The login flow emits the acquired API key directly to stdout JSON. In agent platforms, stdout is commonly captured in logs, transcripts, tool traces, or downstream orchestration, so this can expose long-lived credentials beyond the intended recipient.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script transmits user-supplied query data plus session metadata to a remote service automatically, and the code provides no consent gate, minimization, or warning despite sending SESSION_ID, MODE_ID, and APP_NAME headers. In a skill context, this increases privacy risk because agent users may not realize their search parameters and workflow identifiers are being forwarded off-box.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script persists full API responses to disk by default, including potentially sensitive business data, and does so even when stdout output is summarized. In this skill context, automatic long-lived storage under workspace/home/tmp locations can expose queried product data and metadata to other users, processes, backups, or later collection.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.