Skills legend-shop-supply-api

📦

legend-shop-supply-api

Name: legend-shop-supply-api
Author: legendmall

Content revision r1 Critical 🌐 Network access🔑 Env variables⚙️ External commands

Query LegendShop Supply Products

Merchants need current supplier product data before choosing inventory. This skill queries LegendShop product, inventory, price, and balance data through the platform API.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "legend-shop-supply-api" from https://skillstore.io/skills/legendmall-legend-shop-supply-api.md and its manifest at https://skillstore.io/api/skills/legendmall-legend-shop-supply-api/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/legendmall-legend-shop-supply-api.md Signed manifest GET /api/skills/legendmall-legend-shop-supply-api/manifest Signed lockfile GET /api/skills/legendmall-legend-shop-supply-api/lockfile

Test it

Using "legend-shop-supply-api". Show the first page of available products.

Expected outcome:

Returns a product list summary with product IDs, total count, page information, and next action suggestions.

Using "legend-shop-supply-api". Check details for product 1249846.

Expected outcome:

Returns the product name, price, SKU options, images, and parameters when the API permits access.

Using "legend-shop-supply-api". What is my developer account balance?

Expected outcome:

Returns the API status, success message, and current balance when the token has account permission.

Security Audit

Critical

v4 • 7/6/2026 Open versioned report

The skill legitimately performs network API calls to LegendShop and documents endpoint URLs. The most serious issue is embedded client credentials that can obtain tokens and query developer account balance. Many static Markdown, CSS, and entropy detections are false positives.

Files scanned

1,201

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Critical

scripts/api_client.py:21-22 references/api_spec.yaml:28-32 SKILL.md:26

Hardcoded API Credentials

The script defines a client ID and client secret and uses them to request LegendShop tokens. The OpenAPI spec also publishes the same credential defaults, so any installer can reuse them.

The client ID and secret are literal values in executable code and schema defaults, and the token request uses them directly.

High

scripts/api_client.py:87-99 SKILL.md:52-58 SKILL.md:227-238

Developer Balance Exposure

The skill includes a balance command that uses the shared token to call the developer funds account endpoint. This can disclose account balance data to users who run the skill.

The balance endpoint and output format are documented, and the script implements the call after obtaining the embedded credential token.

Capability review items (19)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/api_spec.yaml:140

Hardcoded URL

- url: http://openapi.legendmall.cn

The spec includes a plain HTTP test server for the balance endpoint. If used, tokens or account data could be sent without TLS.

Medium

scripts/api_client.py:12

Proxy environment variable

os.environ['HTTP_PROXY'] = ''

The script clears HTTP_PROXY before making requests. This can bypass user or enterprise egress controls.

Medium

scripts/api_client.py:13

Proxy environment variable

os.environ['HTTPS_PROXY'] = ''

The script clears HTTPS_PROXY before making requests. This can bypass configured TLS inspection or outbound routing policy.

Medium

scripts/api_client.py:14

Proxy environment variable

os.environ['http_proxy'] = ''

The script clears lowercase http_proxy before making requests. This intentionally avoids proxy settings from the environment.

Medium

scripts/api_client.py:15

Proxy environment variable

os.environ['https_proxy'] = ''

The script clears lowercase https_proxy before making requests. This intentionally avoids proxy settings from the environment.

Medium

scripts/api_client.py:12

Python environment access

os.environ['HTTP_PROXY'] = ''

The code writes to HTTP_PROXY in process environment state. The change is security relevant because it alters outbound routing.

Medium

scripts/api_client.py:13

Python environment access

os.environ['HTTPS_PROXY'] = ''

The code writes to HTTPS_PROXY in process environment state. The change is security relevant because it alters outbound routing.

Medium

scripts/api_client.py:14

Python environment access

os.environ['http_proxy'] = ''

The code writes to lowercase http_proxy in process environment state. This bypasses proxy policy for subsequent requests.

Medium

scripts/api_client.py:15

Python environment access

os.environ['https_proxy'] = ''

The code writes to lowercase https_proxy in process environment state. This bypasses proxy policy for subsequent requests.

Medium

SKILL.md:173-174

Ruby/shell backtick execution

1. **自动获取 Token**: 调用 `api_client.py token` 获取访问令牌

The instructions tell the agent to call the local api_client.py token command. That is intended external command execution, though with fixed arguments.

Medium

SKILL.md:174-175

Ruby/shell backtick execution

2. **查询商品列表**: 调用 `api_client.py list [page] [size]` 获取商品列表

The instructions tell the agent to call the local api_client.py list command. This creates an external process that performs network requests.

Medium

SKILL.md:175-176

Ruby/shell backtick execution

3. **获取商品详情**: 根据 spuId 调用 `api_client.py detail <spuId>` 获取详情

The instructions tell the agent to call api_client.py detail with a product ID argument. The command is expected behavior but still invokes a local executable.

Medium

SKILL.md:176-180

Ruby/shell backtick execution

4. **查询资金余额**: 调用 `api_client.py balance` 获取开发者资金账号余额

The instructions tell the agent to call api_client.py balance. This external command can retrieve financial account data.

Medium

SKILL.md:180-192

Ruby/shell backtick execution

```bash

The bash example contains explicit python scripts/api_client.py commands. These commands run local code that obtains tokens and calls the external API.

Low

preview.html:352

Hardcoded URL

<img src="http://img13.360buyimg.com/n1/jfs/t1/155849/39/30868/22646/632d2df8E5e6eab3b/1df09449d1e36

The preview embeds an external product image over plain HTTP. Rendering the preview can contact a third-party host and expose viewer network metadata.

Low

references/api_spec.yaml:7

Hardcoded URL

- url: https://openapi.legendshop.cn

The OpenAPI spec declares the LegendShop production API host. This is an intended network target, but it is still an external service dependency.

Low

references/api_spec.yaml:138

Hardcoded URL

- url: https://openapi.legendshop.cn

The balance endpoint declares the LegendShop production API host. Clients generated from this spec can make outbound requests there.

Low

scripts/api_client.py:25

Python HTTP libraries

session = requests.Session()

The script creates a requests Session that is used for outbound POST calls. Network access is a real executable capability of the skill.

Low

scripts/api_client.py:20

Hardcoded URL

API_URL = "https://openapi.legendshop.cn"

The executable script hardcodes the LegendShop API host and uses it for token, product, detail, and balance requests.

Risk Factors

🌐 Network access (23)

🔑 Env variables (4)

scripts/api_client.py:12 scripts/api_client.py:13 scripts/api_client.py:14 scripts/api_client.py:15

⚙️ External commands (29)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/legendmall-legend-shop-supply-api/security.svg)](https://skillstore.io/skills/legendmall-legend-shop-supply-api?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/legendmall-legend-shop-supply-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/legendmall-legend-shop-supply-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/legendmall-legend-shop-supply-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

legendmall. (2026). legend-shop-supply-api security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4

BibTeX citation

@techreport{legendmall-legendmall-legend-shop-supply-api-2026,
  author = {legendmall},
  title = {legend-shop-supply-api security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "legend-shop-supply-api security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "legendmall"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4"
identifiers:
  - type: other
    value: "skillstore:legendmall-legend-shop-supply-api:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Source Products for a Store

Browse supplier product IDs and request details for items that may fit a sales channel.

Check Product Data Before Listing

Review price, SKU, image, and parameter data before preparing a product listing.

Verify Developer Account Readiness

Check account balance and API permission messages before running supply chain workflows.

Try These Prompts

Find Products

Show me the first page of supply chain products with 12 items.

Review a Product

Get details for product ID 1249846 and summarize price, stock, SKU options, and images.

Compare Product Options

List products on page 2, then identify which items need detail checks before sourcing.

Audit Account Readiness

Check the developer account balance, then explain whether API permissions or funds block sourcing work.

Best Practices

Confirm permissions and account ownership before running balance queries.
Start with product list results, then request details for selected product IDs.
Treat prices, stock, and balances as live API results that may change.

Avoid

Do not publish shared client secrets in scripts or OpenAPI defaults.
Do not disable proxy settings without explicit user approval.
Do not present sample product data as live API data.

Frequently Asked Questions

Does this skill place orders?

No. It queries products, product details, inventory-related data, and developer account balance.

Which tools can use it?

It declares support for Claude, Codex, and Claude Code.

Does it need network access?

Yes. It calls LegendShop API endpoints and depends on external service availability.

Are credentials included?

The reviewed version contains embedded API credentials. Use secure user-provided secrets instead.

Can it query any product?

No. Access depends on LegendShop permissions and product pool availability.

Is the balance query safe?

Only run it for accounts you own or administer, because it can reveal financial account data.

Developer Details

Author

legendmall

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/legendmall/legend-shop-supply-api/tree/main/

Ref

b8ca75d2c0a7e7102978993058777d82b8ab2610

Maintenance freshness

7/18/2026

Usage

2 downloads · 48 views

File structure

📁 references/

📄 api_spec.yaml

📁 scripts/

📄 api_client.py

📄 icon.svg

📄 LICENSE

📄 preview.html

📄 README.md

📄 requirements.txt

📄 SKILL.md

📄 skill.yaml