linkfox-temu-cancel-order-global

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples and CLI invocation require embedding sensitive tokens (e.g., "accessToken"/storeKey) directly inside the JSON argument passed on the command line, which would force an LLM to output secret values verbatim if it composes such commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 该 skill 在运行时通过用户提供的 JSON 参数直接调用 Temu 网关 /temu/proxy（call_temu_api 解析并打印网关返回的 body/摘要），但其读取的数据来源是 Temu API 响应而非“先不选具体 item 就接收外部作者文本”的队列/订阅式内容。