Temu欧洲站-促销

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:36 AM UTC
• Version: 1.0.5

Overview

The skill performs Temu promotion gateway tasks, but also includes broad API proxying, credential storage/output, account onboarding, and payment-order flows that need careful review.

Install only if you trust LinkFox with your Temu seller tokens, merchant promotion data, LinkFox account key, phone-number login flow, and any payment/order actions. Prefer the dedicated promotion scripts over the arbitrary proxy, avoid passing tokens on the command line, do not use the raw token retrieval helper in shared logs or transcripts, and review stored files under the linkfox and ~/.linkfox paths after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documents use of environment variables, local file writes, and outbound network access, but does not declare permissions or scope them explicitly. This weakens reviewability and least-privilege controls, making it easier for a seemingly narrow promotion skill to access secrets, persist sensitive data, and call external services without clear user awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior extends well beyond EU promotion operations into generic proxying, token storage/retrieval, token validation, and onboarding and payment-related flows. This mismatch is dangerous because users and reviewers may trust a narrow business function while the skill actually exposes broader account, credential, and transaction capabilities that increase the blast radius of misuse or compromise.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The helper unconditionally serializes and saves full API responses to local disk, which can include promotion data, store identifiers, access tokens echoed by upstream services, or other sensitive business data. Because this behavior is generic and not clearly required for the stated API gateway purpose, it creates a persistent local data exposure surface beyond the user’s immediate request.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The code creates session directories, index files, and cross-session metadata tracking skill usage and generated files. While not overtly malicious, this behavior accumulates activity history unrelated to core promotion API forwarding and can expose user behavior, file locations, and operational context if the host is shared or later compromised.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This script provides a direct token-retrieval primitive and returns the access token in cleartext JSON to stdout. In an agent skill context, that materially expands capability beyond narrowly handling promotion operations, because any component that can invoke this helper can obtain bearer credentials and then use them against broader Temu APIs permitted by the token.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements SMS login, API key acquisition, package listing, order creation, and payment QR generation, none of which are necessary for a Temu EU promotion API integration. Such scope divergence is dangerous because it creates a credential-collection and monetization path under the cover of an unrelated skill, increasing the likelihood of social engineering or unauthorized account actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code can create paid orders and generate QR codes for payment, introducing billing and funds-transfer functionality that is unjustified for a Temu promotion integration skill. This can be exploited to trigger unauthorized purchases or pressure users into payments unrelated to the requested business function.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The CLI performs SMS-based account login and then retrieves or generates a LinkFox API token, which materially exceeds the permissions needed for a Temu promotion operations skill. That enables credential bootstrapping and persistent account access, creating a high-risk avenue for account takeover or unauthorized API usage if misused.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file advertises and implements a generic Temu API proxy that forwards requests based on caller-supplied fields such as type and params, while the skill metadata scopes the capability to EU promotion APIs only. This creates a scope-break vulnerability: callers can potentially invoke unrelated Temu operations through the shared proxy path, bypassing intended least-privilege boundaries and exposing broader platform capabilities than the manifest discloses.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code accepts an arbitrary caller-controlled type value and forwards it, along with arbitrary params, to call_temu_api(PROXY_URL, body, ...), with no endpoint-level restriction in this file. In a promotion-focused skill, this effectively turns the skill into a general-purpose API forwarder, which can be abused to access unrelated Temu functions, increasing the blast radius from a narrow business workflow to broad account/API misuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes a state-changing business operation that enrolls goods into a promotion activity and creates a draft/submission flow, but it does not clearly warn users that invoking it can modify live partner-system promotional configuration. In an agent setting, this increases the risk of unintended inventory or pricing-related promotional changes being triggered from ambiguous user requests without explicit confirmation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation exposes a destructive operation (`operateType` 30 to deactivate activity goods) but does not warn users that it removes or disables enrolled goods from a promotion. In an agent skill context, omission of impact warnings increases the chance of accidental high-consequence actions, especially because the file presents the operation alongside routine update actions and includes ready-to-run request examples.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to copy a Temu access token from the seller backend and notes it can be written to a local store, but it provides no warning that the token is a sensitive credential or guidance on secure handling. In this skill context, the token appears to grant direct access to seller APIs, so careless storage, logging, or sharing could enable unauthorized access to store data and operations.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The onboarding workflow is triggered by very broad auth/billing keywords and environment-variable absence, which can cause the skill to activate outside its intended scope. In practice this may redirect unrelated failures into account registration or payment flows, creating opportunities for inappropriate data collection or social-engineering-style prompts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs operators to collect a user's phone number and drive script-based registration, but it does not require consent language, data-minimization guidance, or handling rules for personal data. This creates privacy and compliance risk because users may be induced to disclose sensitive contact information without clear notice of purpose, retention, or alternatives.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide instructs users to copy and save access tokens, but it does not prominently warn that these are sensitive credentials requiring secure storage, restricted access, and redaction from logs or chat transcripts. In an agent skill context, operational guidance that normalizes manual token handling without safety controls can lead to credential exposure, account takeover, or unintended reuse across broader API scopes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code writes complete API responses to disk without user-facing notice or consent, which can persist sensitive payloads long after the request completes. In a shared environment, these files may be accessible to other users, backup systems, or later processes, increasing the chance of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: `eu_file_download_call` accepts a user-controlled `url` and sends it, together with a valid access token, to the file-download backend. If the downstream service fetches arbitrary URLs or authorizes downloads based on that token, an attacker could abuse this as SSRF, trigger retrieval of unintended internal or external resources, or leverage the bearer token in a sensitive download flow. In a promotion/inventory integration skill, this is more dangerous because the function is specifically designed to operate on privileged merchant account context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persists Temu access tokens in a local JSON file in plaintext and does not set restrictive file permissions or use a secure secret store. Anyone with local access to the account, backups, or synced home-directory contents could recover usable API credentials, which is especially relevant because this skill manages e-commerce promotion operations tied to a seller account.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script emits the raw access token to stdout, which can be captured by logs, agent transcripts, tool outputs, shell history wrappers, or downstream consumers. Bearer tokens are effectively credentials, so exposing them this way creates a straightforward path to unauthorized API access and lateral misuse.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code writes QR images and session directories to local filesystem locations including the working directory, user home, and temp directory without clear disclosure or lifecycle controls. Those artifacts may contain payment links or sensitive operational data and could be exposed to other local users, backup systems, or later processes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The order flow can create purchase orders immediately once given a plan ID and method, without an explicit confirmation prompt, transaction summary acknowledgment, or secondary authorization. In a conversational or agent-driven setting, this raises the risk of accidental or unauthorized purchases initiated through prompt confusion or misuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script explicitly instructs users to pass an access token on the command line, which exposes the secret to process listings, shell history, audit logs, and tooling that captures argv. Because this token is then stored for later API reuse, compromise of the token could enable unauthorized access to Temu partner functions until the token expires or is revoked.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.