linkfox-shopee-store-ams

SUSPICIOUS. The skill’s features fit Shopee AMS management, and there is no clear malware pattern or dangerous installer. However, routing all API traffic and server-side token injection through LinkFox developerProxy and an extra third-party proxy is a meaningful trust and data-flow concern, especially combined with dependency on another skill for auth.

The fragment appears to implement an API-backed Shopee automation skill rather than an overt malware payload. It intentionally transmits API keys, session metadata, store identifiers, request bodies, and possibly access tokens to a configurable third-party gateway, and stores complete responses locally. These actions may be legitimate for the stated integration but create significant trust, credential exposure, and sensitive-data-at-rest concerns. The adjacent subprocess script and omitted remainder require review before use. No clear malicious behavior is demonstrated in the provided portion.