linkfox-shopee-store-returns

SUSPICIOUS: The skill's purpose broadly matches its capabilities, and there is no evidence of malware, hidden execution, or hostile installers. However, data flow is not direct to Shopee: credentials and return/refund data are sent through LinkFox proxy infrastructure, with docs also naming a further 'shopee-proxy' intermediary, and the skill auto-posts feedback to a LinkFox endpoint. That intermediary routing is the main risk and makes the skill higher-risk than a direct official Shopee integration.

The presented fragment outlines a standard proxy-based integration pattern for accept_offer, with risk primarily from credential management and data handling through the proxy and dependencies. No malicious code is evident, but credential exposure potential and reliance on external components warrant careful operational controls: strict input validation, minimal logging of sensitive fields, secure secret management, and auditing of the gateway/proxy behaviors. Overall, moderate risk, evolving with deployment practices.