linkfox-amazon-store-aplus-content

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 该 skill 在运行时通过 developer_proxy_get/get/post 调用 POST /spApi/developerProxy 向 Selling Partner API 读取/透传 A+ 文档与发布记录响应体（由用户入参选择 path/contentReferenceKey/asin 等），并把 body JSON 直接解析后落盘/摘要输出，但不对第三方社区/票据/邮箱/网页等“无须先选择条目”的外部自由文本源进行自动摄取。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged one literal high-entropy value and ignored the obvious placeholders/examples.

Flagged: scripts/onboarding.py contains a base64url/JWT-like literal assigned to _LOGIN_FIXED_UID ("eyJhX2lkIjoi..."). It's a non-trivial, opaque token-like string used as a fixed uid header for the login chain ("登录链路固定 uid header（实测可用）") — such a value can be usable for authentication/identification and therefore meets the definition of a secret.

Ignored items (not flagged):

• Example placeholders in SKILL.md / references/api.md (e.g., export LINKFOXAGENT_API_KEY "", sellerId "A1...", "ACCESS_TOKEN") — these are documentation placeholders.
• Short/simple example strings like "A1..." or "B0XXXXXXXXXX" — low-entropy examples that are not real credentials.