Temu店铺查询

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.9

Overview

The skill is a disclosed Temu store-query integration, but it also handles account login, API-key issuance, paid order creation, and local saving of results in ways users should review carefully before installing.

Install only if you trust LinkFox and are comfortable with the skill using a LinkFox API key, sending Temu query data to LinkFox, optionally collecting a Chinese phone number and SMS code for account onboarding, creating payment orders when you choose a plan, and saving full query results locally. Avoid setting custom LINKFOX_* endpoint environment variables unless you control the destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The code builds request destinations from environment-controlled base URLs and then sends sensitive login and token-management traffic with requests.post. In this script, those requests can carry phone numbers, SMS codes, access tokens, refresh tokens, and API-token issuance calls, so a malicious or misconfigured environment can redirect them to an attacker-controlled endpoint and exfiltrate credentials.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 96% confidence
• Finding: The gateway URL is derived from environment variables and used in urllib.request.urlopen with the Authorization header populated from LINKFOX API key material. That creates a credential exfiltration path: if the environment is attacker-influenced, outbound requests for account, package, order, and payment operations can be redirected to an arbitrary server that receives the API key.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 93% confidence
• Finding: The request URL and outbound headers are influenced by environment variables, including LINKFOX_TOOL_GATEWAY and session/app identifiers, and the script sends the API key in the Authorization header to that destination. If an attacker can control the environment or execution context, they can redirect requests to an arbitrary server and exfiltrate credentials and query data over the network.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, yet its content indicates access to environment variables, networked APIs, and local file writing via the referenced script. That mismatch can prevent informed consent and review, making it easier for the skill to access secrets or perform side effects that operators and users did not explicitly approve.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is Temu store querying, but the referenced behavior includes SMS login, API key acquisition, account lookup, plan listing, order creation, payment QR generation, and payment status checks. This is a major scope expansion into authentication and billing flows, which increases the chance of credential handling, unintended purchases, privacy exposure, and social-engineering style misuse under the guise of a simple analytics skill.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account onboarding, SMS login, API key acquisition, package listing, ordering, and payment QR generation, none of which are necessary for a Temu store query skill. The mismatch between declared skill purpose and actual behavior is dangerous because it can socially engineer users into providing phone numbers, verification codes, and payment actions under the guise of a store-analysis tool.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script can fetch or generate API tokens after completing SMS-based authentication and team selection. In the context of a Temu store query skill, this is especially dangerous because it enables credential creation unrelated to the advertised function, potentially granting persistent access to LinkFox accounts and team resources.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code supports package purchase, order creation, payment URL handling, and QR rendering, which is outside the scope of a Temu store search tool. Because the skill context suggests analytics but the code initiates financial transactions, it raises the risk of unauthorized or deceptive purchases and payment phishing behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to match many generic Temu-related requests, causing the skill to activate outside a narrowly intended scope. Because the skill can lead into paid third-party API usage and onboarding flows, over-triggering increases the risk of unnecessary data access, unwanted external calls, and accidental cost incurrence.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs the agent to collect a user's phone number and use it to trigger registration/login flows against an external service, but it provides no privacy disclosure, consent language, or data-handling limitation. This creates a real privacy and trust risk because users may not understand that their phone number is being transmitted to a third-party service and used for account creation/authentication.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The script writes payment QR code PNG files into a session directory on disk without clear disclosure or cleanup. While not a direct exploit by itself, it can leave behind sensitive payment artifacts and URLs that may be accessible to other local users, processes, or later sessions on shared systems.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script always saves the full API response to local storage, including when output is large and only a summary is shown on stdout. This creates a persistent local copy of potentially sensitive business data in predictable locations, increasing exposure to later unauthorized access, indexing, backup leakage, or cross-task data retention.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: External transmission is expected for an API client, but here the transmission includes authentication and onboarding data and is coupled with environment-overridable endpoints. That combination makes the network behavior security-relevant because sensitive user data can be sent off-box to unintended destinations.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.