Temu欧洲站-退货退款

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:38 AM UTC
• Version: 1.0.5

Overview

This skill is mostly disclosed, but it gives a returns/refunds agent much broader gateway, credential, local storage, and payment-related power than the narrow purpose suggests.

Install only if you are comfortable with this skill acting as a broad LinkFox/Temu gateway, not just a narrow EU returns/refunds helper. Use dedicated least-privilege tokens where possible, avoid plaintext token storage on shared machines, review and clean the local linkfox response archives, and do not use the phone login or payment commands unless you explicitly intend to register, retrieve an API key, or purchase credits.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents capabilities to read environment variables, write files, and make network requests, but it does not declare permissions or narrowly scope those capabilities. In practice this weakens reviewability and consent boundaries, especially because the same skill handles API keys, access tokens, and return/refund data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is a narrow EU returns/refunds integration, but the documented behavior includes broader account onboarding, API key lifecycle actions, payment/order flows, local token storage, and generic proxy access. This mismatch creates a confused-deputy risk where operators may approve or invoke a skill expecting limited aftersales actions while it can reach far broader and more sensitive functions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest presents the skill as limited to 9 Returns & Refunds APIs, yet the documentation exposes generic proxy and token-management functions that expand its effective scope. This increases the chance of unauthorized or unexpected operations under the cover of a narrowly described business workflow.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Local persistence, retrieval, and listing of Temu access tokens is sensitive credential handling that is not necessary for a simple returns/refunds execution surface. Storing tokens locally raises theft, reuse, and accidental disclosure risks, especially when combined with file-write capability and session-based persistence patterns elsewhere in the skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Generic multi-site proxy and file-download scripts exceed the documented EU returns/refunds scope and can be repurposed for broader access than reviewers or users expect. That wider surface area increases the chance of misuse, data exfiltration, or unintended API invocation outside the intended business process.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The onboarding document directs the agent into account registration, login, API key acquisition, and plan purchase workflows that are unrelated to a Temu EU returns/refunds skill's declared purpose. This expands the skill from a narrow commerce-support function into credential handling and payment facilitation, increasing phishing, abuse, and unauthorized data-collection risk if triggered during normal support flows.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The document explicitly routes auth and billing errors into separate onboarding and payment procedures, which is behavior outside the manifest's declared returns/refunds scope. Scope expansion is dangerous because users invoking an aftersales skill may be unexpectedly asked to perform sensitive actions like registration, key setup, or payment, creating an opportunity for social engineering and misuse.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The helper unconditionally writes full API responses to local files under a persistent session directory, which expands the skill from simple API forwarding into local data retention. Returns/refunds APIs can contain customer identifiers, order details, addresses, refund status, and other sensitive business data, so persisting raw responses increases exposure if the host is shared, compromised, or logs are later collected.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This code builds a reusable cross-session archive structure and index.jsonl catalog of prior executions, creating a durable local inventory of API activity unrelated to the stated proxy role. That broadens the blast radius from a single invocation to historical data aggregation, making later discovery, correlation, or exfiltration of sensitive commerce records easier.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This script returns any Temu access token from the local store based on caller-supplied parameters and is not constrained to the skill’s stated EU returns/refunds purpose. In a skill context, that becomes a credential-exfiltration primitive: an agent or user can request unrelated tokens and obtain raw bearer credentials that may authorize broader Temu operations beyond aftersales workflows.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements a broad onboarding and monetization CLI—SMS login, API key issuance, package listing, ordering, and payment state queries—that is unrelated to a Temu EU returns/refunds integration. The mismatch materially increases risk because the skill can collect credentials and initiate purchases under the cover of an unrelated business function.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can create orders and generate payment QR codes even though the skill is described as a returns/refunds API integration. In the context of an unrelated operational skill, embedded purchase capability is especially dangerous because it can trigger financial actions users and reviewers would not reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The script exposes generic signed file-download functionality even though the skill is described as handling EU returns and refunds workflows. This scope mismatch is dangerous because it can expand the agent's effective capabilities beyond what users and reviewers expect, potentially allowing retrieval of arbitrary signed files or sensitive artifacts if upstream authorization is weak or misused.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The file’s implemented behavior does not match the skill’s declared purpose: instead of EU returns/refunds handling, it exposes a generic signed-file download capability. In an agent skill, this kind of scope drift is dangerous because it can enable data retrieval outside the user-expected domain, increase the attack surface, and bypass policy or review assumptions tied to the manifest.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module documentation explicitly describes a general signed file downloader, which contradicts the skill metadata claiming EU returns/refunds functionality. Misleading documentation and manifest mismatch can conceal sensitive capabilities from reviewers and users, making unauthorized file access or data handling more likely to go unnoticed.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file is presented as an EU returns/refunds skill, but its own docstring and request shape implement a generic Temu API proxy driven by a caller-supplied `type`. That creates capability expansion beyond the declared scope, enabling use of unrelated Temu APIs through this skill and undermining least privilege and user/operator expectations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: `build_request` accepts arbitrary user-controlled `type` and passes arbitrary `params` to `call_temu_api(PROXY_URL, ...)`, effectively exposing a general upstream API dispatcher. In the context of a narrowly scoped returns/refunds skill, this can be abused to invoke unintended Temu operations, potentially accessing or modifying data outside the intended aftersales workflow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly recommends storing a live Temu access token on disk in a predictable local file path and shows example commands that persist the secret, but it does not warn that the token is sensitive or describe filesystem permission requirements, encryption, rotation, or risks from backups and multi-user hosts. If that file is readable by other local users, malware, support tooling, or accidentally committed/synced, an attacker could reuse the token to access Temu business APIs and perform or inspect aftersales operations.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The document explicitly describes an API that returns personal contact and address data such as recipient name, email, phone numbers, and full return address, but provides no warning about handling sensitive personal data, least-privilege access, masking, logging restrictions, or lawful-use constraints. In an agent skill, this omission can lead downstream developers or operators to expose, over-collect, or log PII during troubleshooting and automation, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This documentation instructs users to upload return labels, tracking numbers, warehouse IDs, and pickup certificate image URLs to an external API without any privacy, data-handling, or sensitivity warning. Those fields can contain sensitive commercial and shipping data, and the absence of explicit guidance on minimization, redaction, consent, and secure URL handling increases the risk of unintended disclosure to third parties or of exposing customer/order metadata through externally hosted files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instructions tell the operator to ask for a user's phone number and use it in a scripted registration/login flow, but provide no privacy notice, consent language, retention limits, or data-handling safeguards. In the context of a returns/refunds skill, collecting personal contact data for external account creation is especially risky because it is unexpected and may normalize disclosure of sensitive information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide repeatedly instructs operators to copy and save an access token, but it does not clearly label the token as a sensitive secret or warn against exposing it in logs, chats, source control, or shared storage. In a skill that brokers Temu partner APIs, this increases the chance of credential mishandling and unauthorized API access if the token is copied into insecure locations.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script prints the access token in plaintext JSON to stdout, which can leak secrets into agent transcripts, logs, shell history capture, observability pipelines, or downstream tools. Because access tokens are bearer credentials, anyone who obtains the output may be able to impersonate the store integration and perform unauthorized API actions until the token expires or is revoked.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.