TikTok官方-店铺订单

• Outcome: Review
• Latest audit: Jul 30, 2026 · 12:25 PM UTC
• Version: 1.0.0

Overview

This skill is mostly transparent about querying TikTok Shop orders, but it includes a broad generic proxy that can reach more API paths and methods than the stated list/detail purpose.

Install only if you trust the LinkFox gateway and need TikTok Shop ERP order access. Treat it as broader than a simple order list/detail helper: restrict who can use order_proxy.py, prefer the named scripts, avoid logging raw order responses, and redact customer PII unless explicitly needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as limited to ERP order list/detail queries, but the documented behavior includes generic proxying for broader order/* and authorization/* endpoints plus helper flows such as get_authorized_shops. That mismatch can mislead users, reviewers, and policy controls, enabling use of more powerful API surface than expected and potentially exposing shop metadata or permitting unintended operations if backend allowlists are weak.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documentation claims the skill is only for ERP order queries, yet it explicitly states the proxy whitelist includes authorization/. Even if intended for shop selection support, mixing authorization endpoints into an order-only skill broadens accessible scope and increases the chance of privilege confusion, data exposure, or policy bypass through an unexpectedly capable proxy.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file documents a shop-authorization discovery API inside a skill whose stated scope is order-only operations. Even if it is only reference material, including an extra capability can enable an agent or maintainer to invoke broader account-discovery functionality than users intended, expanding data access beyond least privilege.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Authorization and shop-discovery capability is not justified by the described purpose of querying order lists and order details. In this context, exposing a way to enumerate authorized shops can leak tenant/shop metadata and make lateral access or unintended cross-shop queries easier if an agent uses the wrong shop context.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The generic `run_order_proxy` function accepts user-controlled `path` and `method` and forwards them through `developer_proxy_call` with only a superficial `order/` prefix check for `shop_cipher`. This bypasses the skill's documented scope of read-only order list/detail operations and effectively exposes a broad ERP API relay, which could be abused to invoke unintended endpoints or non-read actions if the upstream proxy permits them.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: For a skill described as limited to order lookup, exposing arbitrary path/method forwarding creates an unnecessary capability escalation: callers can supply raw `queryString`, `body`, and `requestBody` and reach APIs beyond `get_order_list`/`get_order_detail`. In this context, the mismatch between declared functionality and actual forwarding behavior makes the issue more dangerous, because higher-level policy or user expectations may assume the skill is read-only while the code is not.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The docstring states this is a 'Generic proxy: path + method + openId (+ optional shop_cipher)', which understates the real risk of the function: it forwards arbitrary paths, methods, query strings, and bodies. While the misleading documentation is not the root cause, it can conceal the breadth of capability during review and increase the chance that unsafe generic forwarding remains deployed in a skill that should be narrowly scoped.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill metadata explicitly states it does not include authorization, yet the path allowlist permits 'authorization' routes through developerProxy. That broadens the reachable API surface beyond the declared scope and could let callers access auth-related endpoints using this order skill, undermining separation of duties and policy assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script exposes a `get_authorized_shops` capability that appears outside the manifest’s stated order-only functionality. Even if used as a prerequisite for order APIs, it expands the accessible data surface by enumerating shops tied to an `openId`, which can enable unauthorized discovery of account/shop relationships if the surrounding authorization model is weak or mis-scoped.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The documentation says this is an order API helper, but the implemented action is authorized-shop retrieval. This mismatch can hide real behavior from reviewers and policy enforcement, increasing the chance that a broader-scope data access path is approved or invoked under incorrect assumptions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document explicitly exposes and normalizes handling of highly sensitive order and buyer data, including recipient names, addresses, phone numbers, buyer identifiers, payment details, and market-specific identifiers such as CPF/CNPJ-related fields, without any privacy, minimization, masking, or access-control guidance. In a reusable agent skill, this increases the likelihood that downstream implementations log, display, retain, or share personal data more broadly than necessary.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This skill exposes an API that returns detailed order information including recipient name, address lines, phone number, buyer notes, buyer nickname, and other order-linked identifiers, but the documentation does not warn that these fields are sensitive or require strict minimization and access control. In an agent setting, lack of explicit privacy guidance increases the risk that downstream prompts, logs, or UI responses will disclose customer PII more broadly than necessary.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill documents and enables retrieval of extensive order data that includes sensitive buyer and recipient information such as names, address details, phone numbers, buyer identifiers, and other order-linked personal data, but it does not present any explicit privacy warning, data-minimization guidance, or handling restrictions. In the context of an agent skill, that omission increases the risk of over-collection, inappropriate disclosure in conversations, or use beyond least-privilege expectations, especially because the skill is designed to make order lookups easy via a proxy using only shop selection and openId context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.