linkfox-shopee-store-shop-flash-sale

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This package instructs downloading and installing a ZIP directly from agent-files.linkfox.com (a direct file-hosted release archive), which is a high-risk distribution pattern for unverified executables and should be treated as suspicious until verified by the user/vendor.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Runtime path: the skill calls Shopee via POST /shopee/developerProxy, then merge_shopee_body() parses proxy["body"] (outsider-authored response text from an external API) and emit_result() prints/summarizes that response into stdout/LLM-visible output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime guidance (SKILL.md) instructs downloading and installing remote code from https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip when a dependency is missing, which would fetch and install executable skill code that can control prompts/behavior.