Temu美国站-促销管理

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:37 AM UTC
• Version: 1.0.5

Overview

This looks like a real LinkFox/Temu promotion connector, but it also handles broad API proxying, credentials, local storage, and billing flows that need review before installation.

Install only if you are comfortable giving this skill LinkFox and Temu credential access, allowing it to write local response archives, and using its bundled onboarding/billing scripts. Prefer least-privilege tokens, avoid unmasking or printing tokens, review saved files under linkfox/ and ~/.linkfox, and use the payment/onboarding commands only after explicit user confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 93% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents use of environment variables, local file writes, and outbound network access, but no explicit permission declaration is present. That weakens reviewability and least-privilege controls, making it easier for a broadly capable skill to access secrets, persist sensitive data, and call external services without clear user or platform visibility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is a Temu US promotion wrapper, but the skill also exposes generic proxying, signed downloads, token storage/retrieval, onboarding, API key management, and payment-related flows. This broader operational surface can be abused to perform actions unrelated to the user's expected task, increasing the chance of secret handling, account operations, and external transactions under a misleadingly narrow description.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The helper writes full API responses to local session files by default, which can include access tokens, product data, promotion details, customer-related fields, or other sensitive business data returned by the gateway. Persisting complete responses extends the data exposure surface beyond transient API proxying and creates a local confidentiality risk if the host, workspace, temp directory, or logs are later accessed by another process or user.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This code establishes a reusable local archive structure and session index for collected responses, creating durable tracking of skill activity that is not necessary for simple promotion API forwarding. Such archival behavior increases the blast radius of any sensitive data returned by the API and makes later discovery or bulk exfiltration easier.

Description-Behavior Mismatch

Medium

• Confidence: 79% confidence
• Finding: The script accepts an arbitrary tokenPurpose from caller input and returns the corresponding raw access token, which can enable access outside the promotion-only scope implied by the skill metadata. In a skill advertised for Temu US promotion workflows, exposing a generic token retrieval primitive increases the chance of cross-capability abuse if the same token store contains tokens for broader APIs.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This script enumerates locally saved Temu access tokens and allows unmasking them via a user-controlled parameter, which directly exposes sensitive credentials. Access tokens can enable unauthorized API access, account impersonation, and abuse of promotion-management capabilities, and this functionality is not necessary for a promotion API skill's normal operation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements LinkFox account onboarding, SMS login, API-key retrieval, package listing, ordering, and payment QR generation, which are unrelated to a Temu US promotion connector. The mismatch in declared skill purpose versus actual capability increases the chance of unnecessary credential collection and sensitive account/payment actions being triggered under false pretenses.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can create orders and render payment QR codes, introducing billing capability not justified by a Temu promotion API integration. In this context, such functionality expands the blast radius from data access to direct financial actions, making abuse or user deception materially more harmful.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill performs SMS-based login, fetches user/team information, and obtains or generates API tokens for LinkFox accounts, which exceeds the justified capability of a Temu promotion connector. This creates a hidden credential brokerage path inside an unrelated skill, increasing the risk of unauthorized account access and token exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs users to save Temu access tokens locally in a predictable file path and shows example commands containing raw secrets, but it does not explicitly warn that these are sensitive credentials or prescribe secure storage controls. This increases the risk of credential leakage through shell history, insecure file permissions, backups, shared workstations, or accidental disclosure, which could enable unauthorized API access to Temu seller resources.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs users to supply sensitive credentials such as LINKFOXAGENT_API_KEY, accessToken, storeKey, and Authorization/Token values to a gateway and upstream API, but it provides no warning about secure handling, storage, redaction, or transmission of those secrets. In an agent-skill context, this increases the risk that users will paste production tokens into prompts, logs, scripts, shell history, or third-party gateways without understanding exposure boundaries.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The example command includes an API key and access token directly in environment variables and CLI arguments without warning that these are sensitive secrets. In practice, command-line arguments and shell history may be exposed to other local users, logs, process monitors, or support tooling, which can lead to credential disclosure and unauthorized API access.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The onboarding trigger relies on broad substring matches such as 'unauthorized', 'quota', and 'insufficient', which can cause the skill to activate for unrelated failures or attacker-controlled error text. In this context, misrouting into an auth/billing onboarding flow is risky because it can prompt users to disclose phone numbers, obtain API keys, or initiate payment steps when the original issue was not actually authentication or billing related.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The guide instructs users to copy and save an access token using another script, but it does not prominently warn that the token is a sensitive credential requiring secure storage and restricted handling. In an agent skill context, normalizing token copying/saving without security guidance increases the chance of accidental exposure in logs, files, prompts, or shared environments, which could enable unauthorized API access.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code saves complete API responses to disk without any built-in disclosure or consent mechanism in this module, so users may reasonably assume data is only being proxied or displayed transiently. Silent local persistence of potentially sensitive business data is a security and privacy concern because it changes how long and where data exists.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persists Temu access tokens in plaintext JSON on local disk without setting restrictive file permissions, encryption, or any safety checks. If the host is multi-user, backed up, compromised, or the home directory is readable by other processes, these long-lived credentials can be exposed and reused to access the seller account APIs.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The file-download helper accepts a user-supplied URL and forwards it together with a valid access token to a remote download API. If the downstream service fetches arbitrary URLs, this can enable SSRF-like behavior, unintended access to internal or sensitive resources, or token-associated abuse against untrusted URLs; the promotion skill context makes this more concerning because the feature is exposed in an API integration path rather than a tightly constrained internal workflow.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script prints the retrieved accessToken in plaintext JSON to stdout, which can be captured by calling agents, logs, shell history, process monitors, or downstream tooling. Because access tokens are bearer credentials, disclosure can allow unauthorized API access with the privileges of the associated Temu store account.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code retrieves or generates an API token and returns it to stdout JSON without any in-file user-facing warning or confirmation step. In a skill environment, stdout is often captured by the host or logs, so emitting long-lived credentials can lead to inadvertent secret disclosure beyond the immediate user session.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The QR rendering routine writes payment QR images to disk under workspace/home/temp paths without explicit disclosure or cleanup. Because these QR codes can represent payable orders, leaving them on disk can expose payment artifacts to other local processes or later users of the same environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script explicitly persists a sensitive access token to a local store for later reuse, but provides no user-facing warning, no visible encryption, and no indication of storage protections in this file. If the local environment is shared, backed up insecurely, or later compromised, the stored token could be recovered and reused to access Temu partner APIs.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill requires full API responses to be written to a predictable local session path and encourages later extraction from those files. Promotion API responses and related workflows can contain access tokens, store identifiers, business data, or other sensitive fields, so persistent local storage materially increases exposure through filesystem access, retention, logs, backups, or accidental reuse in later prompts.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 88% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.