linkfox-temu-add-product-us

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs passing secrets (LINKFOXAGENT_API_KEY, Temu accessToken/storeKey) directly on the command line / in JSON arguments (e.g., export and python ... '{"accessToken":"TOKEN",...}'), which requires the LLM/agent to handle or emit secret values verbatim and risks exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Required runtime path calls Temu LinkFox gateway (scripts/_temu_common.py:95-121), then parses and emits the upstream JSON response (scripts/_temu_us_common.py:89-91, scripts/_temu_common.py:308-332), which can include outsider-authored free text (e.g., errorMsg/message/string fields) into the agent-visible stdout context.