linkfox-shopee-store-bundle-deal

SUSPICIOUS. The skill’s business purpose matches Shopee Bundle Deal management, but its real data flow is through LinkFox proxy infrastructure rather than Shopee’s official API directly, and it depends on another skill for auth. That makes the footprint broader than a simple Shopee API wrapper and creates medium risk from credential mediation, transitive trust, and local storage of full API responses, though there is no strong evidence of outright malware or deceptive payload execution.

The fragment appears to implement an external Shopee API gateway and local response-recording workflow rather than malware. It deliberately transmits an API key, session metadata, store identifiers, optional access tokens, and request data to a configurable external service, which is a significant trust and privacy boundary. It also stores complete responses locally without visible permission hardening or redaction. No clear malicious payload, persistence mechanism, destructive behavior, or obfuscation is evident in the supplied code. Review the gateway ownership, TLS and authentication design, file permissions, and the omitted remainder plus check_auth_dependency.py before deployment.