友鹰-Shopee商品搜索

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:43 PM UTC
• Version: 1.0.7

Overview

The skill's Shopee search function is coherent, but it also handles phone-based account login, API-key issuance, paid order creation, and automatic feedback reporting that users should review before installing.

Install only if you are comfortable using LinkFox as a paid external service for Shopee product data. Before running onboarding, confirm that you intend to send your phone number, SMS code, account/team details, and API credentials to LinkFox endpoints, and avoid setting gateway/login URL override environment variables unless you fully trust the destination. Treat order creation and payment QR commands as paid actions requiring explicit confirmation, and avoid sending sensitive business or personal details through the automatic feedback path.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive login and token material to them via requests.post. In a skill execution environment, a malicious or compromised host can override these variables to redirect SMS login flows, access tokens, refresh tokens, and API-key generation traffic to attacker-controlled endpoints, causing credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway URL is also derived from environment variables and used in urllib.request.urlopen with the bearer API key in the Authorization header. An attacker who can influence environment configuration can redirect these authenticated requests to their own server and capture the API key and account metadata, enabling unauthorized API use and billing abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs use of environment variables, networked API calls, and persistent file writes, but no permissions are explicitly declared. This creates a transparency and least-privilege problem: an agent or reviewer cannot easily tell that the skill can access secrets, contact external services, and write data to disk, increasing the risk of unintended data exposure or abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is Shopee product search, but the skill also directs workflows for authentication, account lookup, API key generation, package listing, order creation, payment QR rendering, and payment status checks. That behavior materially expands the trust boundary into account and billing operations, which could be abused to trigger purchases, collect sensitive identifiers, or manipulate user accounts under the guise of a product-search tool.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documentation adds a separate external feedback API that is unrelated to the core Shopee product-query function, creating an unexpected secondary data flow. If an agent follows this guidance, user content and conversation-derived details could be transmitted to another service without clear necessity, consent, or purpose limitation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS login, API-key issuance, plan listing, and paid order management, which is materially broader than a Shopee product information skill. In the skill context, this overreach is dangerous because it prompts collection of phone numbers, verification codes, and billing actions unrelated to the declared purpose, expanding the attack surface and enabling credential/payment abuse.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The order creation and QR-payment rendering logic enables the skill to initiate purchases and display payment artifacts despite the skill being described as a product-selection tool. In this context, hidden monetization capability is risky because it can steer users into unintended transactions or abuse an existing API key to create billable orders.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script performs SMS-based authentication, obtains access/refresh tokens, enumerates team membership, and retrieves or generates API keys, none of which are necessary to search Shopee products. In this context, requesting phone numbers and verification codes creates a credential-harvesting path and can expose long-lived API credentials that grant broader account access than users expect.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger criteria explicitly allow activation even when the user does not mention the tool or Shopee, as long as the request loosely relates to product selection. Overbroad activation increases the chance the skill runs in unintended contexts, causing unnecessary data access, external API usage, or paid operations without sufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The feedback endpoint instructs sending free-form content to a separate external service but does not warn that user-provided text may leave the primary tool boundary. This can lead to unannounced exfiltration of user prompts, business data, or sensitive context under the guise of feedback collection.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The onboarding flow instructs the operator to collect a user's phone number and send it to an external registration/login script, but it provides no privacy notice, consent guidance, data-minimization requirement, or handling restrictions. This creates a real risk of improper collection and transmission of personal data, especially because the skill operationalizes account creation and authentication against a third-party service.

Static analysis

No suspicious patterns detected.