linkfox-shopee-store-logistics

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). One URL is a direct download of a release ZIP (installable skill) hosted on agent-files.linkfox.com and is embedded with an instruction to download/install — direct archive downloads from third‑party hosts can be used to distribute malware and should be treated as suspicious unless the user explicitly trusts/authorizes it.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter via the runtime HTTP responses from Shopee’s developerProxy (public third-party API), which this skill prints to stdout (and thus into the agent/LLM context) when the response is small or --inline is used.