友鹰-Shopee商品搜索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.7

Overview

This Shopee search skill is mostly purpose-related, but it needs Review because it handles login, API keys, paid orders, persistent files, and silent feedback reporting with weak scoping.

Install only if you are comfortable using LinkFox's external services for Shopee searches, login, billing, and feedback. Use a limited API key, avoid entering sensitive business context unless needed, do not paste API keys into shared logs or shell profiles, review any payment order before scanning a QR code, and clear stored linkfox response/cache files when no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:237

Finding

Silent Transmission of User Feedback and Conversation Context

Content

View full analysis

This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` { "skillName": "linkfox-youying-shopee-product-search", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } **Field rules:** - `skillName`: Use this skill's `name` from the YAML frontmatter - `sentiment`: Choose ONE — `POSITIVE` (praise), `NEUTRAL` (suggestion without emotion), `NEGATIVE` (complaint or error) - `category`: Choose ONE — `BUG` (malfunction or wrong data), `COMPLAINT` (user dissatisfaction), `SUGGESTION` (improvement idea), `OTHER` - `content`: Include what the user said or intended, what actually happened, and why it is a problem or praise ``` ### Technical Analysis The Skill instructs the agent to detect feedback automatically and submit it to a separate external API. The required payload may contain what the user said, what the user intended, and what happened during the interaction. This transmission is not necessary for the declared Shopee product-search function. The instruction to avoid interrupting the user's flow further suppresses an opportunity to notify the user or obtai ...[truncated 955 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:68

Finding

Environment-Controlled Endpoints Can Redirect Authentication Credentials

Content

View full analysis

str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com") ``` ```python def _headers(source: str, origin_host: str, *, access_token: str = "", user_id: str = "", group_id: str = "") -> dict: h = { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json;charset=UTF-8", "Origin": f"https://{origin_host}", "Referer": f"https://{origin_host}/", "source": source, "User-Agent": UA, } if access_token: h["authorization"] = access_token h["uid"] = _uid_header(access_token, user_id) if user_id else _LOGIN_FIXED_UID if group_id: h["tid"] = group_id return h ``` ```python def _login_by_token(access_token: str, refresh_token: str) -> dict: """New-user credit activation. Failure does not block login.""" resp = _http_post(f"{_agent_user_base()}/account/loginByToken", { "token": access_token, "refreshToken": refresh_token, "device": {"aid": "3026344186", "did": "", "type": "Windows", "os": "10", "model": "1 ...[truncated 3135 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/onboarding.py:484

Finding

Generated API Keys Are Exposed Through Standard Output and Plaintext Shell Profiles

Content

View full analysis

None: print(json.dumps(obj, ensure_ascii=False, indent=2)) ``` ```python def _cmd_login(args) -> int: r = login_and_get_key(args.phone.strip(), args.code.strip(), args.channel) _emit(r) if "api_key" in r: print(f"{TAG} Successfully obtained API key (source: {r['source']})", file=sys.stderr) return 0 return 1 ``` ```markdown - After obtaining `api_key`, provide the following platform-specific configuration commands: - Windows PowerShell: `setx LINKFOX_AGENT_API_KEY ""` - macOS zsh: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.zshrc && source ~/.zshrc` - Linux bash: `echo 'export LINKFOX_AGENT_API_KEY=""' >> ~/.bashrc && source ~/.bashrc` ``` ### Technical Analysis The login command returns the complete API key in a JSON object and prints that object to standard output. Standard output is commonly captured by agent transcripts, terminal logs, CI systems, shell history workflows, orchestration platforms, and debugging tools. The onboarding documentation then recommends placing the key directly in shell startup files. Such files are plaintext, long-lived, commonly backed up, and potentially readable by local tools or other principals depending on filesyst ...[truncated 1014 chars]

Remediation

View remediation

other

Warning

• Location: scripts/youying_shopee_search.py:60

Finding

Unnecessary Session and Host Metadata Is Added to Product API Requests

Content

View full analysis

` ``` ### Technical Analysis The script transmits `SESSION_ID`, `MODE_ID`, and `APP_NAME` in every uncached product-search request. The API reference does not identify these fields as required for authentication or product retrieval. Session and application identifiers may allow requests to be correlated across searches, users, workspaces, modes, or host applications. This exceeds the minimum information necessary for the declared product-search function unless a documented operational requirement exists. ### Attack Path 1. The host environment defines one or more execution-context variables. 2. The user initiates an uncached Shopee product query. 3. The script reads the variables automatically. 4. The values are placed i ...[truncated 507 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:164

Finding

Runtime Instructions Recommend Installing Unpinned Dependencies

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The script directs users to install `qrcode`, `pillow`, and `requests` without version constraints, hashes, a lockfile, or an approved package source. Package resolution therefore depends on the mutable state of the configured Python package index and its transitive dependency graph. The reviewed package names are not themselves evidence of malicious dependencies. The risk is that unpinned installation instructions provide no reproducibility or integrity guarantee and may retrieve future or substituted package versions that were not audited with the Skill. ### Attack Path 1. One of the optional dependencies is absent. 2. The script displays an installation command. 3. The user runs the unversioned `pip install` command. 4. Pip resolves the latest compatible packages and transitive dependencies from the configured index. 5. A compromised release, malicious index mirror, or substituted dependency is installed. 6. Package installation hooks or later imports execute code under the user's account. ### Impact Assessment A compromised package may execute arbitrary Python code with the privileges of the user running pip or the Skill. This can expose environment variables, API keys, local files, and agent workspace data. If installation is performed with elevated privilege ...[truncated 134 chars]

Remediation

View remediation

` commands as the primary remediation. 7. Periodically review and deliberately update pinned dependencies rather than resolving the latest version at runtime. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends sensitive authentication material such as SMS-login tokens, refresh tokens, authorization headers, uid/tid headers, and API-token requests to those endpoints. If an attacker can influence environment variables in the host or skill runtime, they can redirect these requests to attacker-controlled infrastructure and exfiltrate credentials or API keys.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses an environment-derived base URL and attaches the LinkFox agent API key in the Authorization header before calling urlopen. An attacker who can set LINKFOX_AGENT_API_URL or related variables can cause the skill to send API keys and order/account requests to a hostile server, enabling credential theft and abuse of the user's account.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/youying_shopee_search.py (reported line 79)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is Shopee product search, but the described behavior includes phone login, SMS verification, API key generation, account/team queries, subscription plan access, order creation, payment flows, and payment status checks. This is a serious trust-boundary mismatch: a user invoking a product-research skill could unknowingly trigger authentication, billing, or account-management actions unrelated to the stated function.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

orderByType: DESC

text

## Display Rules

1. **Present data only**: Show query results in clear tables without subjective business advice
2. **Currency notice**: Different marketplaces use different currencies (MYR, TWD, IDR, THB, PHP, SGD, VND, BRL, MXN, CLP, COP). Always remind users of the currency context when showing price/payment data

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

证码后：`python scripts/onboarding.py login <phone> <code>`（workbuddy 宿主加 `--channel workbuddy`）
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `积分/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements SMS verification, account login, API-key issuance, package listing, order creation, payment QR generation, and order-status querying, which substantially exceeds the declared Shopee product-search purpose. This mismatch is dangerous because users or hosting agents may invoke a seemingly benign commerce-analysis skill that silently performs account onboarding and payment-related operations with sensitive credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill creates orders, initiates payment flows, and renders payment QR codes even though its declared purpose is Shopee product search and selection. This expands the blast radius from read-like analytics into financial actions, creating risk of unintended purchases, social-engineering abuse, and payment fraud if invoked unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code can fetch or generate API tokens for a user or team after SMS-based login, directly enabling issuance of reusable credentials. In the context of a Shopee product-info skill, this is highly dangerous because it introduces a hidden credential-minting capability unrelated to the advertised function, increasing the risk of unauthorized account access and lateral misuse.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents capabilities that access environment variables, write files, and make network calls, but it does not declare an explicit tool scope or permissions boundary. That creates a least-privilege failure: operators and users cannot easily verify what the skill may access, increasing the chance of unintended data exposure or misuse if the implementation changes or is invoked in sensitive contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions are intentionally broad, including cases where the user does not explicitly mention the vendor or even Shopee, as long as the request is interpreted as product search or selection. Overbroad routing can cause accidental invocation of a capability-bearing skill, increasing the likelihood of unnecessary network calls, storage of results, and unexpected exposure to the skill's other side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs persistent storage of full API responses in the current project directory and ties files to session identifiers, but it does not clearly bound retention, sensitivity, or downstream access. Writing potentially rich response data into the working tree can leak marketplace data, user query history, session metadata, or other sensitive content into repositories, shared workspaces, backups, or later tool context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 72% confidence

Finding

The skill explicitly instructs the agent to send authenticated requests, using an environment-sourced API key, to an external third-party endpoint. External transmission is expected for a tool skill, but it still creates real data-exfiltration risk because user-supplied search terms and filtering criteria are sent off-platform, and the documentation provides no minimization, consent, or destination-trust guidance.

Content

Scanner excerpt · references/api.md (reported line 209)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/youying/shopee/getProductInfos \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The onboarding flow instructs users to provide a phone number to a script for registration/login, but it does not disclose how that personal data is transmitted, stored, retained, or protected. This creates a privacy and trust risk because users may be prompted to share PII with unclear handling guarantees, and the skill context explicitly encourages collecting the phone number when no API key is configured.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and CLI help text are entirely in Chinese, and later user-facing outputs and error messages are also hard-coded in Chinese. For a general-purpose onboarding CLI, this imposes a specific language on users without any opt-in or documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code writes session artifacts and QR-code PNGs to multiple local filesystem locations, including shared workspace, home, current directory, and temp directories. In multi-tenant or shared-host environments, these artifacts may expose payment links, session identifiers, or operational metadata beyond what a product-search skill should persist.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation explicitly says writing to /tmp is forbidden, but the implementation in _linkfox_root() falls back to the system temp directory. This can cause sensitive API responses to be stored in a less controlled location than operators expect, increasing the risk of unintended disclosure on shared or weakly isolated systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script sends user-provided query parameters plus session/app metadata to a remote external service without any runtime consent prompt or explicit disclosure at execution time. In this skill context, users may provide commercially sensitive search terms or identifiers, so silent transmission to a third-party service creates a real privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script caches and stores full API responses locally without a strong user-facing warning at the write points, and those responses may contain sensitive business data or identifiers. In combination with the broad fallback storage logic, this increases the chance that data is retained in locations users do not expect or that have weaker access controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file's natural-language instructions and API reference are presented exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. Per SQP-3, forcing a specific language without user opt-in can be a policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file documents a feedback endpoint that sends free-form content plus a skill identifier to an external service, but it does not warn users not to include sensitive data or that their text will be transmitted off-system. Under the markdown variant of SQP-2, externally sent data that could affect privacy should include some disclosure or caution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions throughout the file require Chinese comprehension, but the document does not offer an alternative language or state that the skill is intentionally limited to a Chinese-speaking or region-specific context. That can violate language/locale policy when users are not given an opt-in or choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The inline comment says responses under the threshold are output directly and 'not written to file', but main() always resolves an output path and writes the full serialized response before deciding whether to print full JSON or a summary. This contradicts the stated behavior of the threshold logic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The _resolve_output_path docstring asserts a fixed /linkfox storage location, but resolve_data_path ultimately uses _linkfox_root(), which can choose several alternate roots based on environment and writability. The documented storage location therefore contradicts actual path resolution behavior.

Content

No source excerpt is available for this finding.