TikTok官方-店铺订单

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.2

Overview

This appears to be a real TikTok Shop order helper, but it needs Review because it exposes broader order and authorization access while handling sensitive buyer data.

Install only if you intend to let this skill use LinkFox's ERP gateway for TikTok Shop order data and shop authorization metadata. Limit use to authorized shop operators, avoid surfacing full addresses, phone numbers, tax identifiers, or payment details unless necessary, and consider removing or tightly gating order_proxy.py before production use.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill is presented as an order-list/detail skill, but the documented behavior includes generic developerProxy passthrough and authorization/* access, which expands its effective scope beyond the stated purpose. This can bypass user and reviewer expectations, enabling access to additional APIs or sensitive shop metadata under the same trusted skill boundary, especially because it relies on backend-managed tokens and a proxy that retries automatically.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file documents and maps an authorization/shop-enumeration API inside a skill whose declared scope explicitly excludes authorization. That creates capability drift: an agent using this skill could discover authorized shops and obtain shop cipher values not expected by the skill boundary, expanding access beyond order-only behavior and undermining least-privilege assumptions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The inline mapping table explicitly states that get_authorized_shops is part of '本 skill' even though the metadata says authorization is excluded. This inconsistency is dangerous because agents and maintainers may trust the local reference over the manifest, enabling unintended shop-listing and retrieval of shop identifiers/ciphers that can be used in downstream shop APIs.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The `run_order_proxy` function accepts arbitrary `path` and `method` values and forwards them to `developer_proxy_call`, which bypasses the skill's declared scope of only supporting order list/detail APIs. This creates a capability-expansion issue: any caller that can invoke this skill may reach undeclared ERP endpoints, potentially including write-capable or sensitive APIs, with only minimal logic around `shop_cipher` resolution.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The code calls `authorization/202309/shops` to resolve `shop_cipher`, which is outside the documented non-authorization scope of the skill. Even though this appears intended as a helper dependency rather than direct user-facing authorization, it still grants this skill access to authorization-related data and broadens what information it can retrieve.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill documentation explicitly exposes that this API returns rich order and buyer data, including recipient name, address, phone number, buyer message, payment details, and other order metadata, but it provides no privacy warning, data-minimization guidance, or handling restrictions. In an agent context, this increases the risk that an assistant retrieves and surfaces personal data too broadly, to the wrong user, or without confirming business need and authorization.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill documentation explicitly exposes an API that returns sensitive buyer and order data, including recipient name, address, phone number, buyer email, CPF/CNPJ-related fields, and payment metadata, but it provides no warning, minimization guidance, or access-control expectations for downstream use. In the context of an agent skill, that omission increases the likelihood that assistants will retrieve and display unnecessary PII to users who may not be authorized, causing privacy leakage and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented API response includes customer personal data such as recipient name, address details, phone number, and buyer identifiers, but the skill description and usage guidance do not mention privacy sensitivity, data-minimization expectations, or access-control constraints. In an agent skill context, this increases the chance that an agent retrieves and exposes more customer data than necessary for the user’s task, creating unnecessary PII disclosure risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This file contains a generic network-forwarding primitive that can call arbitrary ERP API paths without any built-in user confirmation, safety interstitial, or operation classification. In the context of an agent skill, that increases the risk of unintended or prompt-induced outbound actions, especially when combined with the unrestricted `path`/`method` behavior.

Static analysis

No suspicious patterns detected.