Temu店铺查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.9

Overview

The skill is mostly coherent as a paid LinkFox Temu store-query integration, but it handles login credentials, API keys, and payment orders in ways users should review carefully.

Install only if you are comfortable giving this skill a LinkFox API key and using its built-in account and billing flows. Prefer getting and storing credentials through LinkFox's official site or an OS credential manager, avoid pasting SMS codes or API keys into logged terminals, and do not use custom LINKFOX_* API endpoint variables unless you fully trust the destination.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:76

Finding

Authentication secrets can be redirected to attacker-controlled endpoints

Content

View full analysis

str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _login_v3(phone: str, code: str, channel: str) -> dict: resp = _login_post("/user/v3/web/login", { "type": "sms", "method": "login", "systemId": "LinkFoxAgent", "data": {"areaCode": "+86", "authPhone": phone, "authCode": code, "sourceChannel": channel or "skill"}, }) ``` ```python def _login_by_token(access_token: str, refresh_token: str) -> dict: """New-user credit activation. Failure does not block execution.""" resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "149.0.0.0", "brand": "Chrome"}, }, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token)) ``` ```python def _get_or_generate_api_token(access_token: str, user_id: str, group_id: str) -> dict: hdr = _headers("agent-linkfox-web", "ai.linkfox.com", access_token=access_token, user_id=user_id, group_id=group_id) for path, source in (("/group/getApiToken", "existing"), ("/group/generateApiToken", "generated")): resp = _http_post(f"{_agent_user_base()}{path}", {"id": group_id}, hdr) ``` The query script contains the same unsafe pattern: ```pyt ...[truncated 2170 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:488

Finding

Verification codes and API keys are exposed through process arguments, stdout, and shell profiles

Content

View full analysis

``` ```bash setx LINKFOX_AGENT_API_KEY "" echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc ``` The script returns the complete API key and serializes it to standard output: ```python return { "api_key": tok["api_key"], "phone": masked, "group_id": info["group_id"], "member_id": info["member_id"], "source": tok["source"], "nick_name": lg.get("nick_name", ""), "team_name": info.get("team_name", ""), "is_new_user": lg.get("is_new_user", False), } ``` ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key", file=sys.stderr) return 0 return 1 ``` ### Technical Analysis Passing an SMS verification code as a positional command-line argument exposes it to shell history and, depending on the operating system and process isolation, process-inspection utilities. Printing the generated API key to stdout can expose it to terminal logs, agent transcripts, command-capture systems, CI logs, and redirected output. Persisting the key in `.bashrc`, `.zshrc`, or the user environment leaves a long-lived plaintext credential available to other processes running as the same user. It may also be captured by backups, support bundles, shell-profile synchronization, or accidental repository inclusion. ### Attack Path 1. The user follows the documented login command with the phone num ...[truncated 1038 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:162

Finding

Runtime installation of unpinned third-party packages creates supply-chain risk

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The script instructs users to install `qrcode`, `pillow`, and `requests` without version constraints, hashes, a lock file, or a documented trusted package index. Package installation can execute package build or installation code, and unpinned requirements allow future releases to change after the skill has been reviewed. The package names shown are common packages rather than evident typosquatting attempts, and the audit found no proof that they are currently malicious. The risk arises from mutable, unauthenticated-by-project dependency resolution and the absence of reproducible dependency controls. ### Attack Path 1. A required package is absent. 2. The script directs the user to run an unpinned `pip install` command. 3. The package resolver downloads whichever compatible release is current from the configured package index. 4. A compromised package release, package index, dependency, or local index configuration supplies malicious installation or import-time code. 5. That code executes with the privileges of the user running the installation or onboarding script. ### Impact Assessment A malicious dependency can execute arbitrary code under the installing user's account. Depending on local privileges, it could read credentials, alter project files, access user data, or e ...[truncated 178 chars]

Remediation

View remediation

other

Note

• Location: scripts/temu_store_query.py:61

Finding

Store-query requests transmit unnecessary session and host-application metadata

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (22)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds destination URLs from environment variables such as LINKFOX_LOGIN_API_URL and LINKFOX_AGENT_USER_API_URL, then sends SMS login data, access tokens, refresh tokens, and generated API-token requests to those endpoints. If an attacker can influence the runtime environment, they can redirect these sensitive authentication flows to an attacker-controlled server and harvest credentials and tokens.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The gateway URL is derived from environment variables and then used in urllib.request.urlopen with the Authorization header set to the API key. A manipulated environment can redirect authenticated requests for user info, packages, orders, and billing actions to an attacker-controlled endpoint, exposing secrets and enabling unauthorized transaction-related actions.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/temu_store_query.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is store querying, but the detected behavior includes authentication, account access, subscription browsing, payment order creation, QR-code payment generation, and payment-status checks. This is a major trust-boundary violation: a user invoking a store-analysis skill could be funneled into credential handling and billing flows they did not explicitly consent to, enabling unauthorized charges, account misuse, or phishing-like collection of login data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This onboarding document introduces authentication recovery, registration, and billing workflows that are unrelated to a Temu store query skill’s stated purpose. Expanding the skill into account provisioning and payment handling increases attack surface and creates opportunities for credential collection, unauthorized account creation, and social-engineering abuse under the guise of normal skill operation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly instructs the operator to facilitate user registration, login by SMS code, and plan purchase, none of which are justified by a store analytics/query capability. In this context, those capabilities are over-privileged and can be misused to harvest phone numbers, drive users into payment flows, or perform account actions unrelated to the user’s original request.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements LinkFox account onboarding, SMS login, API key acquisition, package listing, order placement, and payment QR generation, which is unrelated to the declared Temu store-query skill. Such a scope mismatch is dangerous because it can be used to socially engineer users into authenticating, purchasing services, or disclosing account credentials under a misleading skill identity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The package retrieval, order creation, and payment QR rendering code adds billing and purchase capabilities that are not justified for a Temu store-query tool. In context, this increases the likelihood of deceptive monetization or unauthorized purchase flows because users would not reasonably expect a store-analysis skill to initiate subscription transactions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The SMS verification, login, token exchange, user-info retrieval, and API-token generation flow is far outside the minimum scope of a Temu store query skill. In this context it is especially dangerous because it facilitates collection of phone numbers, one-time codes, access tokens, refresh tokens, and API keys under misleading pretenses.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill appears to require sensitive capabilities such as environment access, file writing, and network use, but it does not declare any tool scope or permission boundaries. This weakens least-privilege controls and makes it harder for the host or reviewer to verify that the skill cannot access more than is necessary, increasing the blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation text is overly broad and says the skill should trigger even when the user does not mention the tool name, as long as the request is generally about finding or analyzing Temu stores. Over-broad triggering can cause unintended invocation of a skill that carries billing implications and hidden account-related behaviors, creating confused-deputy risks and reducing meaningful user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language content of the skill is entirely Chinese and does not state that language choice is optional or user-driven. Under the policy, forcing a specific language without user opt-in is a potential locale/language policy violation unless the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Feedback API documentation instructs sending free-form content describing user intent and results to an external service, but it does not warn operators to avoid including personal, sensitive, or unnecessary user data. In an agent-skill context, this omission can lead to unintended exfiltration of user-provided content, especially if implementers forward transcripts or detailed prompts verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions permit collecting a user's phone number and using it to trigger SMS-based registration/login flows without any clear privacy disclosure, consent language, or data-handling boundaries. That creates privacy and account-security risk because sensitive personal data and one-time codes may be solicited in a workflow that appears to be part of a simple Temu store query tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and command descriptions are entirely in Chinese, and the workflow is framed around domestic mobile numbers and +86 usage. The policy only allows a fixed language/locale when the skill offers opt-in or clearly documents a justified regional constraint, which is not stated here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring promises that data will only be written under the current working directory and explicitly forbids /tmp, but the implementation falls back to ~/linkfox and the system temporary directory. This mismatch can cause sensitive API responses to be stored in less expected or less protected locations, increasing the risk of inadvertent disclosure on shared systems or when downstream tooling assumes the documented storage guarantees.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code serializes the input parameters and sends them via POST to an external service, along with SESSION_ID, MODE_ID, and APP_NAME headers. Although the module docstring mentions the API path, it does not clearly warn the user that provided data and environment-derived metadata will be transmitted off-machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file presents all operational instructions in Chinese and does not indicate that users may choose another language or that the skill is intentionally restricted to a Chinese-language audience. This can conflict with language/locale policy guidance when no user opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing instructions in the file are written in Chinese, and the workflow assumes Chinese-language interaction without indicating that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script accesses LINKFOX_AGENT_API_KEY or LINKFOXAGENT_API_KEY from the environment to authenticate requests. While this is a normal implementation pattern, there is no explicit user-facing warning in this file that the skill depends on and consumes a sensitive credential from the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.