Security audit

Temu全球站-促销

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Temu/LinkFox promotion API helper, but it handles seller credentials, broad API proxying, local token storage, onboarding, and payment flows beyond a tightly scoped promotion tool.

Review before installing. Use this only with dedicated least-privilege LinkFox and Temu credentials, avoid the arbitrary proxy helpers unless you intend broad seller-account API access, do not save or print raw tokens in shared/logged environments, and require explicit confirmation before deactivation or payment/order actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes network access, environment-variable access, and persistent file writes but does not declare permissions or clearly constrain those capabilities. In a security-sensitive integration that handles API keys, access tokens, and business data, hidden capabilities reduce auditability and can enable unintended data exfiltration or local sensitive-data retention.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is promotion API access, but the skill also includes account onboarding, API key generation/retrieval, payment/order workflows, QR-code rendering, and local token management. This scope expansion materially changes the trust boundary: a user invoking a promotion tool may unknowingly trigger credential handling, billing-related actions, or persistent token storage unrelated to the expected task.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document gives conflicting statements about whether tool use consumes credits. Misstating billing semantics can mislead users or calling agents into making repeated or unapproved calls, potentially causing unexpected charges or bypassing intended caution around retry behavior.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The shared helper unconditionally serializes and stores full API responses to local files, which can include Temu access tokens, promotion data, shop identifiers, and other sensitive business information. Because this behavior is built into a common module and not obviously required for a promotion API wrapper, it creates unnecessary local data retention and expands the exposure surface if the host is shared or compromised.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code creates a reusable cross-session storage area under multiple candidate filesystem roots and caches session metadata there. This introduces persistent local state unrelated to the core API-forwarding purpose, enabling accumulation of historical data across runs and making later discovery or unintended access more likely.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script allows arbitrary tokenPurpose values and returns whatever matching Temu access token exists in the local store, rather than enforcing the promotion-only scope implied by the skill manifest. In an agent skill context, this becomes a capability-expansion issue: any caller able to invoke this helper may obtain tokens for unrelated domains such as product, price, or order operations and then use them against other APIs.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements account onboarding, SMS login, API key issuance, plan listing, and purchase flows that are outside the declared Temu promotion API purpose. This scope mismatch is dangerous because a user invoking a commerce-promotion skill could be led into unrelated credential collection and billing actions, expanding the trust boundary well beyond what the skill advertises.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Order creation and QR payment rendering enable real-money subscription purchases unrelated to Temu promotion management. In the context of a promotion API skill, this hidden billing capability can cause unauthorized or unexpected purchases and local artifact creation, making the mismatch materially risky.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The SMS login and token-generation flow provisions LinkFox account API keys, which is broader account-management functionality than the skill description suggests. Even if intended for setup, embedding this inside a Temu promotion skill increases the chance of credential harvesting, surprise account linkage, or privilege expansion under misleading context.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: This script exposes a generic signed-file download capability even though the skill is described as promotion-focused. That scope mismatch matters because file download endpoints often enable access to arbitrary signed resources, expanding the skill’s effective privileges and increasing the chance of unintended data access or misuse if a caller can supply untrusted URLs or tokens.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script forwards an arbitrary Temu API `type` and unfiltered `params`, making it a generic credential-bearing proxy rather than a promotion-scoped integration. In the context of a skill advertised as promotion-only, this creates a capability mismatch that can be abused to invoke unrelated Temu APIs with the user’s access token, bypassing intended least-privilege and policy boundaries.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module docstring and usage text describe the tool as a general Temu API proxy, which conflicts with the declared promotion-only purpose of the skill. This misleading framing encourages broader use of a sensitive proxy component and increases the chance that operators or downstream agents will send unrelated privileged requests through it.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation instructs users to persist a Temu access token locally in a JSON file but does not clearly frame the token as a sensitive secret or warn about the risks of local plaintext storage. If that file is exposed through weak filesystem permissions, backups, logs, malware, or accidental commits, an attacker could reuse the token to access Temu business APIs and act on the seller account.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation exposes a destructive operation (`operateType` 30, deactivate activity goods) without any cautionary language, confirmation guidance, or guardrails describing its business impact. In an agent skill context, this increases the chance that an LLM or user triggers product deactivation unintentionally, causing listings to be removed from promotions and potentially reducing sales or disrupting campaigns.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The onboarding instructions tell the operator to collect and pass a user's phone number and SMS code to a local script for registration/login, but they do not require explicit consent, data minimization, or a privacy notice. This creates a real privacy and account-security risk because phone numbers and one-time codes are sensitive authentication data and could be mishandled, logged, or exposed to the wrong party.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The guide explicitly instructs users to copy an access token and save it, but it does not warn that the token is a sensitive credential equivalent to account/API access. In this skill context, that omission matters because the file is an authorization guide for production commerce APIs, making accidental insecure storage, logging, or sharing of tokens more likely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code stores Temu access tokens in plaintext JSON on the local filesystem and does not set restrictive file permissions or use an OS credential store. If the host is multi-user, backed up, synced, or compromised by other local processes, these tokens can be read and reused to access seller APIs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script validates a LinkFox token by sending a probe request to the remote gateway, which necessarily transmits the user's credential to an external service. Although this appears functionally intended, the file provides no user-facing warning, confirmation, or explicit consent flow before using the token, which can surprise users and cause unintended credential disclosure to a third party.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script prints the raw access token to stdout in JSON, which can expose secrets to logs, calling processes, transcripts, or downstream tooling that captures command output. In an agent-integrated environment, stdout is often observable by orchestration layers, making token leakage significantly more likely and turning a local helper into a credential exfiltration point.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script accepts a user-supplied JSON argument that can disable masking and then prints locally stored Temu access tokens to stdout. Even though this appears intended for debugging or local administration, exposing bearer tokens in cleartext can lead to credential theft through shell history, terminal logs, CI logs, or other local monitoring, enabling unauthorized API access.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code retrieves or generates API tokens after login without any in-band warning or confirmation at the point of issuance. Silent credential provisioning is risky because users may not realize a persistent API key is being created for their account, and such tokens could later be reused beyond the immediate session.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The order flow can initiate external purchases and writes QR image files locally without an explicit warning immediately before those actions. In a skill whose stated purpose is Temu promotion APIs, undisclosed billing and filesystem side effects are particularly unsafe because they violate user expectations and could trigger unintended purchases or data residue.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script accepts a sensitive access token via command-line JSON and persists it locally without an explicit warning or visible safeguards in this file. Command-line arguments can be exposed through shell history, process listings, logs, or support tooling, so this handling increases the chance of credential disclosure and unauthorized API access.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill instructs that full API responses must always be written to local session-scoped files. Because these responses can contain access tokens, authorization artifacts, pricing/billing data, and sensitive merchant business information, mandatory persistent storage increases exposure through local compromise, accidental inclusion in project files, cross-task leakage, or later reuse beyond the original purpose.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.