linkfox-temu-ads-global
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits Temu marketplace access tokens and LinkFox API keys to the vendor's gateway at tool-gateway.linkfox.com and other subdomains of linkfox.com. These communications are necessary for the proxying and account management services provided by the vendor (linkfox-ai).
- [CREDENTIALS_UNSAFE]: Marketplace tokens are stored in a local file (~/.linkfox/temu-access-tokens.json) to maintain state between script executions. This behavior is clearly documented and managed by the skill's own token storage utilities, representing standard local session management for CLI tools.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Temu API responses. To mitigate potential injection risks, the skill uses structured JSON parsing and provides the raw output for user inspection rather than directly executing or untrusted content.
- [SAFE]: Analysis of the Python scripts and documentation confirms that the skill operates transparently. All external dependencies are standard libraries or well-known packages, and no obfuscation or malicious persistence mechanisms were detected.
Audit Metadata