Temu美国站-退货退款

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:39 AM UTC
• Version: 1.0.5

Overview

This skill mostly discloses its Temu/LinkFox purpose, but it also ships broad proxy, credential-management, billing, and local data-retention capabilities that deserve careful review before installation.

Install only if you trust LinkFox and need this broader Temu gateway toolkit, not just a narrow returns/refunds helper. Use dedicated us_returns_refunds scripts where possible, avoid raw token output and mask=false, store tokens only on a trusted machine, clear saved linkfox response files when no longer needed, and do not set gateway override environment variables unless you control the destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents capabilities to read environment variables, write files, and make network requests, yet exposes no declared permissions boundary to users or reviewers. In a skill that handles API keys, access tokens, order/after-sales data, and remote gateway calls, this lack of explicit permission declaration weakens transparency and consent and increases the chance of overbroad use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially exceeds the stated purpose of a Temu US returns/refunds skill by including account onboarding, API key retrieval/generation, payment-plan purchase flows, generic proxying, file download, and local token management. This mismatch is dangerous because users may invoke the skill expecting a narrowly scoped after-sales tool while it can perform broader account, billing, and token-handling actions that increase credential exposure and misuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The helper unconditionally persists full API responses to local disk, which expands the skill from a simple API proxy into a local data archival mechanism. Returns/refunds responses can contain order, customer, logistics, refund, and token-related data, so writing them to session files creates unnecessary data-at-rest exposure if the host is shared or later compromised.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This code creates a reusable cross-session archive root and index of activity under predictable local paths, increasing the amount and discoverability of sensitive operational data. Even if intended for debugging, building a persistent session index materially broadens exposure beyond the manifest-described API forwarding role.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is a generic access-token retrieval utility and its documented parameters allow fetching tokens for arbitrary sites, management types, and token purposes, not just the returns/refunds capability described by the skill. In a skill scoped to Temu US returns/refunds, exposing a reusable bearer token materially expands privilege and enables use of unrelated APIs if the caller can invoke this script or capture its output.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script accepts validated but potentially broad site and managementType inputs and a free-form tokenPurpose, which means it can retrieve tokens for non-US or otherwise unrelated operational contexts. That exceeds the declared skill purpose and increases blast radius by allowing credential access across environments or business domains if the local token store contains them.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This script adds a credential-enumeration utility to a skill whose declared purpose is Temu US returns/refunds operations. Even though it masks tokens by default, it still exposes the existence and metadata of locally stored access tokens, and the optional `{"mask": false}` path can reveal full secrets if invoked. The mismatch between declared scope and implemented capability makes the skill more dangerous because it introduces credential discovery functionality unrelated to the business workflow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script explicitly enumerates locally saved access tokens and prints them, with a user-controlled option to disable masking. This creates a direct path for credential disclosure to anyone able to execute the script, which can enable unauthorized API access, account takeover of integrations, or broader compromise of Temu-connected operations. In the context of a returns/refunds skill, local credential harvesting is especially unjustified and therefore more suspicious and risky.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill is described as a Temu US returns/refunds integration, but the file implements unrelated onboarding, SMS login, API-key issuance, subscription discovery, order creation, and payment QR generation. That mismatch is a strong indicator of deceptive scope and increases the chance that users are tricked into providing phone verification codes or buying unrelated services.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The file includes package listing, order creation, and QR-code payment rendering despite the skill's stated purpose being aftersales/returns APIs. Hidden commerce flows inside an unrelated integration create risk of unauthorized charges, social engineering, and misuse of the agent environment for monetization.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This script adds a generic signed file download capability that is not described by the skill manifest’s stated Temu US returns/refunds scope. Even if the endpoint is legitimate, scope mismatch is dangerous because it can enable retrieval of arbitrary signed resources under the user’s credentials, expanding the skill’s effective permissions beyond what users and reviewers expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script implements a generic Temu API proxy by accepting an arbitrary `type` and forwarding caller-supplied `params`, `site`, `managementType`, and access token to the backend. That behavior materially exceeds the skill’s declared US returns/refunds-only scope, enabling use of unrelated Temu APIs and expanding the skill into a broad privileged gateway if exposed through the agent.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module documentation explicitly describes a generic Temu API proxy and even gives an example for an unrelated goods-category API, which contradicts the skill’s declared returns/refunds-only purpose. This mismatch is dangerous because it signals and facilitates broader use than intended, increasing the likelihood that operators or downstream tooling will invoke unauthorized APIs through this skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that full API responses are always written to disk but does not warn that these responses may contain sensitive order, refund, address, or after-sales data. Silent persistence of potentially sensitive business and customer information increases the risk of unintended local disclosure, retention beyond necessity, and secondary access by other tools or users on the same system.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly describes an API response containing personally identifiable information such as recipient name, email, phone numbers, and full return address, but it provides no privacy handling guidance, minimization expectations, or warnings against unnecessary disclosure/logging. In a skill that brokers after-sales return workflows, this omission increases the risk that downstream agents or integrators will expose, retain, or misuse sensitive personal data during normal operation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to manually copy an access token from the Temu seller backend and optionally save it to a local store, but it does not warn that the token is a sensitive credential or describe safe storage requirements. This increases the risk of credential leakage through clipboard history, shell history, plaintext local files, shared machines, or backups, which could allow unauthorized API access to store data and operations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that downstream tools can be invoked with a direct accessToken, but it provides no warning about the risks of transmitting credentials to proxy and file-download tooling. Without safeguards, tokens may be exposed in command arguments, logs, traces, crash reports, or intermediary services, enabling unauthorized use of the Temu account APIs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The onboarding flow explicitly allows collecting a user's phone number and using it to register/login via a script, but provides no privacy notice, consent language, retention limits, or handling restrictions. That creates unnecessary exposure of personal data and increases the risk of misuse, leakage, or non-compliant collection in a support flow.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide explicitly instructs users to copy an access token and save it, but it does not present any warning that the token is a sensitive secret, nor does it provide safe-handling guidance. In this skill context, the token grants access to Temu partner APIs for returns, refunds, and aftersales operations, so mishandling could expose account data or enable unauthorized business actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: API responses are written to disk without an explicit user-facing warning or consent flow, despite likely containing sensitive store and aftersales information. This creates a quiet privacy and security risk because users may believe the skill only forwards requests rather than retaining local copies.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists Temu access tokens in plaintext JSON on local disk without setting restrictive file permissions, encryption, or any safety checks. If the host is shared, compromised, backed up insecurely, or the home directory is readable by other users/processes, the tokens can be recovered and used to access seller aftersales APIs.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script performs token validation by making a real request to a remote LinkFox/Temu gateway, but the file itself does not clearly disclose to the user that invoking this check transmits authentication material or derived credentials off-host. In an agent-skill context, users may assume a local validation step, so this can cause unintended credential exposure to an external service and create privacy, auditing, and trust issues if run without explicit consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script prints the raw access token to stdout in JSON, which makes secret exposure likely through logs, agent transcripts, shell history, debugging output, or downstream tools that capture command output. Because bearer tokens are typically sufficient for API access on their own, disclosure can directly enable unauthorized calls until the token expires or is revoked.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.