技能 legend-shop-supply-api
📦
legend-shop-supply-api
内容修订 r1 严重 🌐 网络访问🔑 环境变量⚙️ 外部命令
查询 LegendShop 供应商品
商家在选择库存前需要最新的供应商商品数据。此技能通过平台 API 查询 LegendShop 的商品、库存、价格和余额数据。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "legend-shop-supply-api" from https://skillstore.io/skills/legendmall-legend-shop-supply-api.md and its manifest at https://skillstore.io/api/skills/legendmall-legend-shop-supply-api/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“legend-shop-supply-api”。 显示第一页可用商品。
预期结果:
返回包含商品 ID、总数、分页信息和下一步操作建议的商品列表摘要。
正在使用“legend-shop-supply-api”。 检查商品 1249846 的详情。
预期结果:
在 API 允许访问时，返回商品名称、价格、SKU 选项、图片和参数。
正在使用“legend-shop-supply-api”。 我的开发者账户余额是多少？
预期结果:
在令牌具备账户权限时，返回 API 状态、成功消息和当前余额。
安全审计
严重v4 • 2026/7/6 打开版本化报告
The skill legitimately performs network API calls to LegendShop and documents endpoint URLs. The most serious issue is embedded client credentials that can obtain tokens and query developer account balance. Many static Markdown, CSS, and entropy detections are false positives.
9
已扫描文件
1,201
分析行数
19
复核项
0
已忽略误报
已确认安全问题 (2)
严重
Hardcoded API Credentials
The script defines a client ID and client secret and uses them to request LegendShop tokens. The OpenAPI spec also publishes the same credential defaults, so any installer can reuse them.
The client ID and secret are literal values in executable code and schema defaults, and the token request uses them directly.
高
Developer Balance Exposure
The skill includes a balance command that uses the shared token to call the developer funds account endpoint. This can disclose account balance data to users who run the skill.
The balance endpoint and output format are documented, and the script implements the call after obtaining the embedded credential token.
能力复核项 (19)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Hardcoded URL
- url: http://openapi.legendmall.cn
The spec includes a plain HTTP test server for the balance endpoint. If used, tokens or account data could be sent without TLS.
中
Proxy environment variable
os.environ['HTTP_PROXY'] = ''
The script clears HTTP_PROXY before making requests. This can bypass user or enterprise egress controls.
中
Proxy environment variable
os.environ['HTTPS_PROXY'] = ''
The script clears HTTPS_PROXY before making requests. This can bypass configured TLS inspection or outbound routing policy.
中
Proxy environment variable
os.environ['http_proxy'] = ''
The script clears lowercase http_proxy before making requests. This intentionally avoids proxy settings from the environment.
中
Proxy environment variable
os.environ['https_proxy'] = ''
The script clears lowercase https_proxy before making requests. This intentionally avoids proxy settings from the environment.
中
Python environment access
os.environ['HTTP_PROXY'] = ''
The code writes to HTTP_PROXY in process environment state. The change is security relevant because it alters outbound routing.
中
Python environment access
os.environ['HTTPS_PROXY'] = ''
The code writes to HTTPS_PROXY in process environment state. The change is security relevant because it alters outbound routing.
中
Python environment access
os.environ['http_proxy'] = ''
The code writes to lowercase http_proxy in process environment state. This bypasses proxy policy for subsequent requests.
中
Python environment access
os.environ['https_proxy'] = ''
The code writes to lowercase https_proxy in process environment state. This bypasses proxy policy for subsequent requests.
中
Ruby/shell backtick execution
1. **自动获取 Token**: 调用 `api_client.py token` 获取访问令牌
The instructions tell the agent to call the local api_client.py token command. That is intended external command execution, though with fixed arguments.
中
Ruby/shell backtick execution
2. **查询商品列表**: 调用 `api_client.py list [page] [size]` 获取商品列表
The instructions tell the agent to call the local api_client.py list command. This creates an external process that performs network requests.
中
Ruby/shell backtick execution
3. **获取商品详情**: 根据 spuId 调用 `api_client.py detail <spuId>` 获取详情
The instructions tell the agent to call api_client.py detail with a product ID argument. The command is expected behavior but still invokes a local executable.
中
Ruby/shell backtick execution
4. **查询资金余额**: 调用 `api_client.py balance` 获取开发者资金账号余额
The instructions tell the agent to call api_client.py balance. This external command can retrieve financial account data.
中
Ruby/shell backtick execution
```bash
The bash example contains explicit python scripts/api_client.py commands. These commands run local code that obtains tokens and calls the external API.
低
Hardcoded URL
<img src="http://img13.360buyimg.com/n1/jfs/t1/155849/39/30868/22646/632d2df8E5e6eab3b/1df09449d1e36
The preview embeds an external product image over plain HTTP. Rendering the preview can contact a third-party host and expose viewer network metadata.
低
Hardcoded URL
- url: https://openapi.legendshop.cn
The OpenAPI spec declares the LegendShop production API host. This is an intended network target, but it is still an external service dependency.
低
Hardcoded URL
- url: https://openapi.legendshop.cn
The balance endpoint declares the LegendShop production API host. Clients generated from this spec can make outbound requests there.
低
Python HTTP libraries
session = requests.Session()
The script creates a requests Session that is used for outbound POST calls. Network access is a real executable capability of the skill.
低
Hardcoded URL
API_URL = "https://openapi.legendshop.cn"
The executable script hardcodes the LegendShop API host and uses it for token, product, detail, and balance requests.
风险因素
🌐 网络访问 (23)
preview.html:352 references/api_spec.yaml:7 references/api_spec.yaml:138 references/api_spec.yaml:140 scripts/api_client.py:25 scripts/api_client.py:46 scripts/api_client.py:66 scripts/api_client.py:83 scripts/api_client.py:99 scripts/api_client.py:20 scripts/api_client.py:12 scripts/api_client.py:13 scripts/api_client.py:14 scripts/api_client.py:15 SKILL.md:23 SKILL.md:24 SKILL.md:34 SKILL.md:57 SKILL.md:58 SKILL.md:95 SKILL.md:137 skill.yaml:56 skill.yaml:57
🔑 环境变量 (4)
⚙️ 外部命令 (29)
SKILL.md:23 SKILL.md:24 SKILL.md:32 SKILL.md:34 SKILL.md:41 SKILL.md:54 SKILL.md:57 SKILL.md:58 SKILL.md:82-89 SKILL.md:89-93 SKILL.md:93-95 SKILL.md:95-120 SKILL.md:120-131 SKILL.md:131-135 SKILL.md:135-137 SKILL.md:137-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-180 SKILL.md:180-192 SKILL.md:192-200 SKILL.md:200-207 SKILL.md:207-211 SKILL.md:211-225 SKILL.md:225-229 SKILL.md:229-238 SKILL.md:238-252 SKILL.md:252-256
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/legendmall-legend-shop-supply-api?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/legendmall-legend-shop-supply-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/legendmall-legend-shop-supply-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/legendmall-legend-shop-supply-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
legendmall. (2026). legend-shop-supply-api security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4BibTeX 引用
@techreport{legendmall-legendmall-legend-shop-supply-api-2026,
author = {legendmall},
title = {legend-shop-supply-api security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "legend-shop-supply-api security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "legendmall"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4"
identifiers:
- type: other
value: "skillstore:legendmall-legend-shop-supply-api:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 77
架构
85
可维护性
85
内容
68
社区
83
规范符合性
你能构建什么
为店铺采购商品
浏览供应商商品 ID，并请求可能适合销售渠道的商品详情。
上架前检查商品数据
在准备商品上架前，查看价格、SKU、图片和参数数据。
验证开发者账户准备情况
在运行供应链工作流前，检查账户余额和 API 权限消息。
试试这些提示
查找商品
显示供应链商品第一页，共 12 个商品。
查看商品
获取商品 ID 1249846 的详情，并总结价格、库存、SKU 选项和图片。
比较商品选项
列出第 2 页的商品，然后识别哪些商品在采购前需要进行详情检查。
审计账户准备情况
检查开发者账户余额，然后说明 API 权限或资金是否阻碍采购工作。
最佳实践
- 在运行余额查询前确认权限和账户所有权。
- 先从商品列表结果开始，然后请求所选商品 ID 的详情。
- 将价格、库存和余额视为可能变化的实时 API 结果。
避免
- 不要在脚本或 OpenAPI 默认值中发布共享客户端密钥。
- 未经用户明确批准，不要禁用代理设置。
- 不要将示例商品数据呈现为实时 API 数据。
常见问题
此技能会下单吗？
不会。它查询商品、商品详情、库存相关数据和开发者账户余额。
哪些工具可以使用它？
它声明支持 Claude、Codex 和 Claude Code。
它需要网络访问吗？
需要。它会调用 LegendShop API 端点，并依赖外部服务可用性。
是否包含凭据？
已审核版本包含嵌入式 API 凭据。请改用用户提供的安全密钥。
它可以查询任何商品吗？
不能。访问取决于 LegendShop 权限和商品池可用性。
余额查询安全吗？
仅对你拥有或管理的账户运行它，因为它可能暴露财务账户数据。
开发者详情
作者
legendmall许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
b8ca75d2c0a7e7102978993058777d82b8ab2610
维护新鲜度
2026/7/18
使用量
2 次下载 · 48 次浏览