Security audit

Temu全球站-退货退款

Security checks across malware telemetry and agentic risk

Overview

The skill supports Temu returns work, but it also exposes broad API proxying, credential storage/reveal, saved sensitive responses, and LinkFox account/payment flows that need careful review before use.

Install only if you trust LinkFox and need a Temu returns/refunds gateway with local audit files. Avoid using the generic proxy unless you intend to grant broader Temu API access, do not store long-lived tokens in plaintext on shared machines, rotate any token printed to logs or transcripts, and require explicit user confirmation before onboarding, collecting phone/OTP data, saving credentials, or creating payment orders.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documents use of environment variables, network access, and local file writes, but does not declare permissions or clearly scope those capabilities. That reduces transparency and makes it easier for an agent or user to invoke sensitive behavior without understanding the trust boundary, especially given API token handling and response persistence.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is narrowly framed around Temu global returns/refunds, but the skill also exposes broader capabilities including onboarding, API key generation/retrieval, payment flows, generic proxying, file download, and token storage utilities. This mismatch can mislead operators about what the skill can do and widens the attack surface far beyond the expected aftersales workflow.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation gives conflicting statements about whether calls consume credits, which can cause an agent to make additional requests under false assumptions about cost and authorization. In security-sensitive workflows, inconsistent billing/consent guidance undermines user trust and can lead to unintended paid actions.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The helper unconditionally serializes and saves full API responses to local disk under a session directory. For a returns/refunds integration, responses can reasonably contain order identifiers, aftersales case data, buyer details, and refund information, so this creates an unnecessary local data exposure surface and retention risk beyond the stated gateway purpose.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: This code implements a broader local session/indexing storage layer that tracks sessions, metadata, and saved API output files. That behavior is not clearly required for invoking Temu returns/refunds APIs and increases the amount and discoverability of sensitive business data on disk, which raises privacy, insider access, and post-compromise collection risk.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This utility retrieves a stored Temu access token and prints the raw secret to stdout, making credential disclosure trivial to any caller, wrapper, log collector, or transcript that invokes the script. In the context of a returns/refunds skill, exposing bearer tokens is not necessary for normal business logic and broadens the blast radius to full API misuse if the token is captured.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file implements an onboarding and monetization CLI for LinkFox accounts—SMS login, API-key acquisition, package listing, order placement, and payment QR creation—which is unrelated to a Temu returns/refunds skill. This capability mismatch is dangerous because a user invoking a Temu aftersales skill could be steered into authenticating to an unrelated platform and granting access or making payments outside the declared scope.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code can fetch or generate LinkFox API tokens after SMS-based login, which is a sensitive credential-management capability unrelated to Temu return/refund handling. In the context of this skill, that creates unjustified access expansion: users may disclose phone numbers and OTPs and receive long-lived API credentials for a different service than they intended to use.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Package listing, order creation, and payment QR rendering are commercial account-management features unrelated to Temu returns/refunds. In this skill context, they increase the chance of deceptive or confusing behavior, including inducing payment actions under the banner of a returns/refunds integration.

Description-Behavior Mismatch

High

Confidence: 85% confidence
Finding: This script persists a reusable Temu access token to a local store, which expands the credential exposure surface beyond the stated returns/refunds skill purpose. In an agent-skill context, adding generic token storage functionality can enable broader API access reuse, lateral use by other components, and long-lived compromise if the local store is readable by other users, processes, or logs.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The code accepts an access token from CLI input and saves it for reuse, creating unnecessary persistence of a sensitive bearer credential. Even without an obvious exfiltration path in this file, local storage of reusable tokens increases the chance of theft through filesystem access, backups, debugging artifacts, or unintended cross-skill reuse.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file advertises and implements a generic signed file download capability even though the skill is described as limited to Temu global returns/refunds workflows. Scope-expanding functionality like arbitrary resource download increases the attack surface and can be abused to access or relay sensitive documents through the skill under a misleading permission boundary.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script accepts a caller-supplied URL and forwards it to a file download API with an access token, creating a generic signed-resource retrieval primitive unrelated to a narrow returns/refunds purpose. In a skill whose declared context is aftersales processing, this mismatch is more dangerous because users and reviewers may not expect arbitrary document retrieval, enabling unauthorized access to signed invoices, labels, evidence files, or other sensitive Temu resources if a valid signed URL is provided.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: This script exposes generic file-download capability through `global_file_download_call(params)` while the skill’s declared purpose is limited to Temu Global returns/refunds workflows. Scope expansion like this can enable retrieval of signed or sensitive files unrelated to the advertised aftersales use case, especially because the user-supplied `url` is passed through with no visible allowlisting or workflow restriction in this file. In a gateway skill, undocumented download primitives are more dangerous because they may be chained to access data outside the expected business domain.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file is presented as a Temu returns/refunds skill, but its own description and usage example expose a generic '/temu/proxy' capability with caller-controlled API 'type'. That creates a scope-bypass condition where an agent or user can invoke unrelated Temu APIs through a skill that should be limited to aftersales flows, undermining least privilege and enabling unauthorized operations beyond the manifest's declared purpose.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The code accepts arbitrary user-supplied 'type' and forwards it directly in the request body, with no validation that it belongs to returns/refunds APIs. In the context of a skill advertised for aftersales only, this effectively turns the skill into a general Temu API tunnel, which can be abused to access broader platform functions using the supplied access token.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger text is broad and includes many generic keywords, increasing the chance that the skill activates outside its intended scope. Because the skill can access tokens, call external APIs, and write responses to disk, accidental invocation can expose data or perform actions in the wrong context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill states that full API responses are automatically written to local files, but does not require an explicit warning or consent even though those responses may contain sensitive order, store, customer, or token-related data. Silent persistence increases the risk of local data exposure, retention beyond need, and unintended access by other tools or users on the same workspace.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs users to copy a Temu access token and optionally save it to a local store, but it provides no warning that the token is a sensitive credential or guidance on secure handling. In this skill context, the token appears to authorize seller backend API access for orders, refunds, and aftersales operations, so leakage could enable unauthorized business actions or data access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The onboarding instructions explicitly tell the operator to collect and use a user's phone number to register for an API key, but they provide no privacy notice, consent language, retention guidance, or warning about handling personal data. In a support workflow, this creates avoidable privacy and compliance risk because agents may solicit sensitive personal information and pass it into scripts without clear safeguards.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script writes API responses to disk without clear user-facing notice or consent, which is a security and privacy weakness even if the storage is local. Users may provide authentication and order/refund data expecting transient processing, while the helper silently creates retained artifacts that could later be accessed by other local users, backup systems, or malware.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code persists Temu access tokens in plaintext JSON on local disk and does not set restrictive file permissions or use any secure secret-storage mechanism. If the host is multi-user, backed up, synced, or otherwise accessible to other processes, these tokens can be recovered and used to access partner APIs and act on returns/refunds data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script emits the full access token in a JSON response with no redaction, warning, or safeguards, so operators may unknowingly leak it through terminal history, agent transcripts, CI logs, or observability systems. Because bearer tokens are typically sufficient for authenticated API access, accidental exposure can enable unauthorized returns/refunds operations or wider account actions allowed by the token scope.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code retrieves or generates API tokens and returns them without any explicit in-file warning, consent gate, or explanation of sensitivity. Because this is embedded in a Temu-themed skill, users may not realize they are authorizing creation of powerful LinkFox credentials, increasing the risk of uninformed credential exposure and misuse.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The order flow writes QR code image files into a session directory on disk without an explicit warning in this file. While low severity, silent artifact creation can surprise users, leave payment-related remnants on shared systems, and is especially questionable in a skill whose declared purpose is not billing or onboarding.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.