linkfox-amazon-store-fulfillment-outbound

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime the workflow executes fixed SP-API read operations (e.g., getOrderPreview, getOffers, getOrder, listOrders, getInvoiceHeaders) by POSTing user-supplied JSON into the wrapper which validates and then calls the gateway endpoint /spApi/developerProxy, so outsider-provided free text in that JSON is ingested as queryString/path/requestBody without selecting a specific pre-existing item.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). Found a high-entropy, base64-like literal in scripts/onboarding.py assigned to _LOGIN_FIXED_UID (lines 48-49). The code comments indicate this value is a “登录链路固定 uid header（实测可用）” and it is used as a default UID header for login flows when no access token is present — i.e., an embedded header/token that can be used in authentication requests. This fits the definition of a secret (high-entropy literal that can grant access) and is not a placeholder.

Ignored other candidates: environment variable names (e.g., LINKFOX_AGENT_API_KEY), URLs, example text, and simple strings — these are documentation placeholders or config names and not hardcoded credentials.