Temu欧洲站-税务

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:40 AM UTC
• Version: 1.0.5

Overview

This skill is mostly a disclosed LinkFox-to-Temu tax gateway, but it exposes broader credential, proxy, billing, and local persistence behavior than a narrow EU tax skill should.

Review before installing. Use only if you trust LinkFox with Temu merchant tokens and EU tax/invoice data, avoid using environment URL overrides in normal operation, do not paste or store broad access tokens unless necessary, and treat saved linkfox/ response files and ~/.linkfox/temu-access-tokens.json as sensitive secrets. The publisher should narrow proxy/file-download scripts to the seven tax endpoints, harden or remove plaintext token storage, and make full-response persistence opt-in with redaction.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 92% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 89% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions while the documentation clearly describes use of environment variables, network access to external gateways, and persistent file writes. This weakens user and platform visibility into what the skill can do, increasing the chance that sensitive tax data, API keys, or tokens are handled without informed consent or proper sandboxing.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a narrow EU tax API wrapper, but the documented behavior expands into token storage, generic proxying, signed file download, account onboarding, API key management, payment/order flows, and access-token guidance. This creates a substantial trust-boundary mismatch: users and reviewers may authorize a tax tool while unknowingly granting a broader operational surface that can access credentials, billing, and non-tax platform functions.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation states that a tax-report export API defaults to `tokenPurpose=product-inventory`, which is a scope/authorization mismatch for a sensitive tax endpoint. If operators or downstream tooling rely on this guidance, they may request, reuse, or route credentials under an incorrect purpose, weakening least-privilege controls and potentially enabling broader-than-intended access to tax data.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The example request repeats the contradictory `product-inventory` token purpose for a tax API, increasing the likelihood that users will copy-paste an overbroad or incorrect token configuration into production. In a tax/reporting context, this can cause privilege confusion, accidental exposure of financial data, or bypass of intended authorization boundaries if the gateway does not strictly enforce purpose separation.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The script usage example propagates the same token-purpose mismatch into executable operational guidance, making misuse more likely during real runs. Because this endpoint initiates export of tax/sales reports, incorrect scope documentation can lead to mishandled credentials and unauthorized access to regulated financial information.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation for a tax API states a default tokenPurpose of "product-inventory," which can cause callers to use a token scoped for the wrong business domain. In a gatewayed environment handling tax documents and upload signatures, this scope confusion can lead to authorization mistakes, accidental cross-domain access, or misuse of credentials against unintended APIs.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documentation for a tax invoice API sets the default gateway token purpose to `product-inventory`, which is inconsistent with the skill's stated tax-only scope. In a gatewayed integration, an incorrect default auth context can cause privilege/scope confusion, leading callers to use a broader or unrelated token than intended and increasing the risk of unauthorized access to tax/invoice data or accidental cross-domain API use.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: Presenting `product-inventory` as the inline default for a tax-focused invoice endpoint contradicts the endpoint's security boundary and can mislead integrators into reusing the wrong credential scope. This kind of scope-mismatch documentation flaw is dangerous because developers often copy defaults verbatim, potentially normalizing overprivileged token usage or causing authorization behavior that bypasses least-privilege expectations.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The documentation claims gateway authentication is handled by the skill, yet the example requires the caller to supply an access token directly, creating ambiguity about who is responsible for credential handling. In addition, specifying `tokenPurpose=product-inventory` for a tax-report API risks overbroad or mismatched authorization, which can lead to unauthorized access patterns or accidental token reuse across domains.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The document states a default tokenPurpose of `product-inventory` for a tax invoice upload API, which is a scope/authorization mismatch. If the gateway accepts broader or incorrect token scopes, callers may use an inventory-scoped credential to perform tax/document operations, weakening least-privilege boundaries and increasing the chance of unauthorized access or misuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The shared helper unconditionally serializes and saves full API responses to local disk. In this skill’s context, those responses can plausibly contain tax records, invoice metadata, download URLs, access tokens, or other business-sensitive data, creating persistent local exposure beyond the stated API-forwarding purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This helper is explicitly for EU tax APIs, but it silently defaults tokenPurpose to "product-inventory" whenever a storeKey is provided without an accessToken. That creates a scope/intent mismatch that can cause the gateway to resolve a broader or wrong credential than the caller expects, increasing the chance of unauthorized access to non-tax capabilities or accidental cross-scope data exposure.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The code comments and skill metadata present this module as tax-only, yet the implementation intentionally injects a product/inventory token purpose by default. In a security-sensitive proxy flow, this kind of misleading scope selection undermines least privilege and can route requests through credentials with access unrelated to tax operations, making misuse and operator error more likely.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is a generic token retrieval utility that accepts arbitrary site, managementType, and tokenPurpose values and returns the raw Temu access token from local storage. In a skill advertised as EU Tax-only, this creates a scope-expansion path where callers can obtain broader Temu credentials for unrelated domains, enabling misuse of stored tokens outside the declared capability boundary.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module documentation explicitly shows usage for site='cn' and tokenPurpose='product-inventory', which is inconsistent with an EU Tax skill. This mismatch signals that the utility is designed or reused for broader contexts than declared, increasing the chance of accidental or intentional use of non-EU, non-tax credentials within this skill boundary.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file implements package purchase, order creation, and payment QR generation even though the skill is described as a Temu EU tax API forwarder. This hidden expansion of scope increases risk because users invoking a tax-related skill could instead be guided into account monetization and payment flows unrelated to the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script's primary behavior is LinkFox account onboarding, SMS login, and API-key provisioning, not Temu EU tax operations. In skill ecosystems, this mismatch is dangerous because it can trick users or host agents into disclosing phone numbers and verification codes to obtain credentials under the guise of a tax API integration.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file exposes a general-purpose signed file download flow even though the skill is घोषित as an EU tax API wrapper. This scope expansion matters because it enables retrieval of arbitrary resources reachable through Temu signed URLs, creating a capability not justified by the manifest and increasing the risk of data exfiltration or misuse under a tax-only permission expectation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script accepts a user-supplied URL and forwards it for signed download using the caller's Temu access token, without any visible restriction that the URL be tied to an approved tax artifact. In a tax-only skill, this creates an unnecessary arbitrary-download primitive that could be abused to access unintended files if an attacker can supply or influence signed URLs.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The module documentation describes a generic 'Temu Signed File Download' capability, which conflicts with the manifest's narrow EU tax-only purpose. This mismatch is dangerous because it signals undocumented broader behavior, making operator review, least-privilege scoping, and user trust decisions inaccurate.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script is described and registered as an EU Tax-specific skill, but its interface and example usage implement a generic Temu proxy that forwards arbitrary API types via a shared proxy endpoint. This creates a scope-bypass/confused-deputy risk: users or downstream agents may invoke unrelated Temu APIs through a skill that should only expose a narrowly scoped tax surface, potentially reaching broader account capabilities than intended.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The code accepts a caller-supplied site and only applies generic site validation, even though the skill metadata says it is for Temu Europe tax workflows. Allowing non-EU sites broadens the reachable backend surface and defeats the skill's declared trust boundary, enabling use of the skill for other regions and potentially other business functions when combined with arbitrary type forwarding.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger conditions are broad and keyword-based, covering common terms like VAT, invoices, export report, and site=eu tax references. Overbroad activation raises the risk that the skill is invoked in contexts where sensitive financial or tax data is not intended to be sent to the LinkFox gateway, causing accidental data exposure or unnecessary external calls.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.