linkfox-temu-add-product-us

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill's examples and invocation patterns show API tokens/accessToken being passed directly on the command line (and an export of a raw API key), which would require an agent to include secret values verbatim when constructing commands or examples.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path: user-supplied JSON passed to scripts/us_goods_list.py (via _us_product_script.py → _temu_us_common.us_proxy_call → _temu_common.call_temu_api/parse_nested_body) is sent to the gateway and the returned gateway JSON is parsed and emitted (including full response saved/printed) without first selecting a specific trusted item.