linkfox-shopee-store-fbs

SUSPICIOUS. The skill’s purpose matches Shopee FBS status lookup, but its data flow is mediated by a LinkFox proxy that receives credentials and request data before Shopee, and it always writes full responses locally. No clear malware, exploit, or hidden execution is present, but the third-party proxy model, local persistence, and transitive dependency make the footprint higher-risk than a direct Shopee integration.

The shown code appears to be a legitimate API integration and response-caching utility, not clear malware. It deliberately transmits an API key and optional Shopee access token to a configurable external gateway, so the gateway and environment configuration must be trusted. The unsanitized SESSION_ID used in filesystem paths is a security weakness that can enable path traversal or unintended file writes under attacker-controlled environments. Review the missing remainder and the adjacent check_auth_dependency.py before deployment.