linkfox-temu-ads-us

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples that place secrets (LINKFOXAGENT_API_KEY, Temu accessToken) inline in shell commands/JSON, which would require the LLM to emit those secret values verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Required workflow calls the Temu gateway at runtime and then prints/summarizes the gateway’s JSON response (including body/errorMsg/result strings) into the agent context via stdout, which is outsider-authored free text from Temu’s API.