技能 legend-shop-supply-api
📦
legend-shop-supply-api
內容修訂 r1 嚴重 🌐 網路存取🔑 環境變數⚙️ 外部命令
查詢 LegendShop 供應產品
商家在選擇庫存前需要最新的供應商產品資料。此技能會透過平台 API 查詢 LegendShop 的產品、庫存、價格與餘額資料。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "legend-shop-supply-api" from https://skillstore.io/skills/legendmall-legend-shop-supply-api.md and its manifest at https://skillstore.io/api/skills/legendmall-legend-shop-supply-api/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「legend-shop-supply-api」。 顯示可用產品的第一頁。
預期結果:
傳回產品清單摘要，包含產品 ID、總數、頁面資訊與下一步動作建議。
正在使用「legend-shop-supply-api」。 檢查產品 1249846 的詳細資料。
預期結果:
當 API 允許存取時，傳回產品名稱、價格、SKU 選項、圖片與參數。
正在使用「legend-shop-supply-api」。 我的開發者帳戶餘額是多少？
預期結果:
當權杖具有帳戶權限時，傳回 API 狀態、成功訊息與目前餘額。
安全審計
嚴重v4 • 2026/7/6 開啟版本化報告
The skill legitimately performs network API calls to LegendShop and documents endpoint URLs. The most serious issue is embedded client credentials that can obtain tokens and query developer account balance. Many static Markdown, CSS, and entropy detections are false positives.
9
已掃描檔案
1,201
分析行數
19
複核項目
0
已忽略的誤報
已確認的安全問題 (2)
嚴重
Hardcoded API Credentials
The script defines a client ID and client secret and uses them to request LegendShop tokens. The OpenAPI spec also publishes the same credential defaults, so any installer can reuse them.
The client ID and secret are literal values in executable code and schema defaults, and the token request uses them directly.
高
Developer Balance Exposure
The skill includes a balance command that uses the shared token to call the developer funds account endpoint. This can disclose account balance data to users who run the skill.
The balance endpoint and output format are documented, and the script implements the call after obtaining the embedded credential token.
能力複核項目 (19)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
Hardcoded URL
- url: http://openapi.legendmall.cn
The spec includes a plain HTTP test server for the balance endpoint. If used, tokens or account data could be sent without TLS.
中
Proxy environment variable
os.environ['HTTP_PROXY'] = ''
The script clears HTTP_PROXY before making requests. This can bypass user or enterprise egress controls.
中
Proxy environment variable
os.environ['HTTPS_PROXY'] = ''
The script clears HTTPS_PROXY before making requests. This can bypass configured TLS inspection or outbound routing policy.
中
Proxy environment variable
os.environ['http_proxy'] = ''
The script clears lowercase http_proxy before making requests. This intentionally avoids proxy settings from the environment.
中
Proxy environment variable
os.environ['https_proxy'] = ''
The script clears lowercase https_proxy before making requests. This intentionally avoids proxy settings from the environment.
中
Python environment access
os.environ['HTTP_PROXY'] = ''
The code writes to HTTP_PROXY in process environment state. The change is security relevant because it alters outbound routing.
中
Python environment access
os.environ['HTTPS_PROXY'] = ''
The code writes to HTTPS_PROXY in process environment state. The change is security relevant because it alters outbound routing.
中
Python environment access
os.environ['http_proxy'] = ''
The code writes to lowercase http_proxy in process environment state. This bypasses proxy policy for subsequent requests.
中
Python environment access
os.environ['https_proxy'] = ''
The code writes to lowercase https_proxy in process environment state. This bypasses proxy policy for subsequent requests.
中
Ruby/shell backtick execution
1. **自动获取 Token**: 调用 `api_client.py token` 获取访问令牌
The instructions tell the agent to call the local api_client.py token command. That is intended external command execution, though with fixed arguments.
中
Ruby/shell backtick execution
2. **查询商品列表**: 调用 `api_client.py list [page] [size]` 获取商品列表
The instructions tell the agent to call the local api_client.py list command. This creates an external process that performs network requests.
中
Ruby/shell backtick execution
3. **获取商品详情**: 根据 spuId 调用 `api_client.py detail <spuId>` 获取详情
The instructions tell the agent to call api_client.py detail with a product ID argument. The command is expected behavior but still invokes a local executable.
中
Ruby/shell backtick execution
4. **查询资金余额**: 调用 `api_client.py balance` 获取开发者资金账号余额
The instructions tell the agent to call api_client.py balance. This external command can retrieve financial account data.
中
Ruby/shell backtick execution
```bash
The bash example contains explicit python scripts/api_client.py commands. These commands run local code that obtains tokens and calls the external API.
低
Hardcoded URL
<img src="http://img13.360buyimg.com/n1/jfs/t1/155849/39/30868/22646/632d2df8E5e6eab3b/1df09449d1e36
The preview embeds an external product image over plain HTTP. Rendering the preview can contact a third-party host and expose viewer network metadata.
低
Hardcoded URL
- url: https://openapi.legendshop.cn
The OpenAPI spec declares the LegendShop production API host. This is an intended network target, but it is still an external service dependency.
低
Hardcoded URL
- url: https://openapi.legendshop.cn
The balance endpoint declares the LegendShop production API host. Clients generated from this spec can make outbound requests there.
低
Python HTTP libraries
session = requests.Session()
The script creates a requests Session that is used for outbound POST calls. Network access is a real executable capability of the skill.
低
Hardcoded URL
API_URL = "https://openapi.legendshop.cn"
The executable script hardcodes the LegendShop API host and uses it for token, product, detail, and balance requests.
風險因素
🌐 網路存取 (23)
preview.html:352 references/api_spec.yaml:7 references/api_spec.yaml:138 references/api_spec.yaml:140 scripts/api_client.py:25 scripts/api_client.py:46 scripts/api_client.py:66 scripts/api_client.py:83 scripts/api_client.py:99 scripts/api_client.py:20 scripts/api_client.py:12 scripts/api_client.py:13 scripts/api_client.py:14 scripts/api_client.py:15 SKILL.md:23 SKILL.md:24 SKILL.md:34 SKILL.md:57 SKILL.md:58 SKILL.md:95 SKILL.md:137 skill.yaml:56 skill.yaml:57
🔑 環境變數 (4)
⚙️ 外部命令 (29)
SKILL.md:23 SKILL.md:24 SKILL.md:32 SKILL.md:34 SKILL.md:41 SKILL.md:54 SKILL.md:57 SKILL.md:58 SKILL.md:82-89 SKILL.md:89-93 SKILL.md:93-95 SKILL.md:95-120 SKILL.md:120-131 SKILL.md:131-135 SKILL.md:135-137 SKILL.md:137-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-180 SKILL.md:180-192 SKILL.md:192-200 SKILL.md:200-207 SKILL.md:207-211 SKILL.md:211-225 SKILL.md:225-229 SKILL.md:229-238 SKILL.md:238-252 SKILL.md:252-256
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/legendmall-legend-shop-supply-api?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/legendmall-legend-shop-supply-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/legendmall-legend-shop-supply-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/legendmall-legend-shop-supply-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
legendmall. (2026). legend-shop-supply-api security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4BibTeX 引用
@techreport{legendmall-legendmall-legend-shop-supply-api-2026,
author = {legendmall},
title = {legend-shop-supply-api security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "legend-shop-supply-api security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "legendmall"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/legendmall-legend-shop-supply-api/audits/4"
identifiers:
- type: other
value: "skillstore:legendmall-legend-shop-supply-api:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 77
架構
85
可維護性
85
內容
68
社群
83
規範符合度
你可以打造什麼
為商店尋找產品來源
瀏覽供應商產品 ID，並請求可能適合銷售通路的商品詳細資料。
上架前檢查產品資料
在準備產品上架前，檢視價格、SKU、圖片與參數資料。
驗證開發者帳戶準備狀態
在執行供應鏈工作流程前，檢查帳戶餘額與 API 權限訊息。
試試這些提示
尋找產品
顯示供應鏈產品的第一頁，共 12 個項目。
檢視產品
取得產品 ID 1249846 的詳細資料，並摘要價格、庫存、SKU 選項與圖片。
比較產品選項
列出第 2 頁的產品，然後識別哪些項目在採購前需要詳細資料檢查。
稽核帳戶準備狀態
檢查開發者帳戶餘額，然後說明 API 權限或資金是否阻礙採購工作。
最佳實務
- 執行餘額查詢前，先確認權限與帳戶擁有權。
- 先從產品清單結果開始，再針對選定的產品 ID 請求詳細資料。
- 將價格、庫存與餘額視為可能變動的即時 API 結果。
避免
- 請勿在指令碼或 OpenAPI 預設值中發布共用的用戶端密鑰。
- 未經使用者明確核准，請勿停用代理設定。
- 請勿將範例產品資料呈現為即時 API 資料。
常見問題
此技能會下訂單嗎？
不會。它會查詢產品、產品詳細資料、庫存相關資料與開發者帳戶餘額。
哪些工具可以使用它？
它宣告支援 Claude、Codex 與 Claude Code。
它需要網路存取嗎？
需要。它會呼叫 LegendShop API 端點，並依賴外部服務可用性。
是否包含憑證？
已審查版本包含嵌入式 API 憑證。請改用安全的使用者提供密鑰。
它可以查詢任何產品嗎？
不能。存取取決於 LegendShop 權限與產品池可用性。
餘額查詢安全嗎？
只能針對你擁有或管理的帳戶執行，因為它可能揭露財務帳戶資料。
開發者詳細資訊
作者
legendmall授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
b8ca75d2c0a7e7102978993058777d82b8ab2610
維護新鮮度
2026/7/18
使用量
2 次下載 · 48 次瀏覽