linkfox-temu-cancel-order-us
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with LinkFox-owned infrastructure at tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com. These connections are used to proxy Temu API requests and manage LinkFox account details such as plans and login sessions. These are verified vendor resources aligned with the skill's purpose.
- [DATA_EXPOSURE_EXFILTRATION]: The skill manages sensitive credentials including LinkFox API keys and Temu access tokens. It implements a local storage mechanism in the user's home directory (~/.linkfox/temu-access-tokens.json) to persist Temu tokens for reuse. This is a documented configuration practice for the vendor's toolset and does not involve exfiltration to unauthorized parties.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data from Temu API responses. To mitigate potential risks associated with large or untrusted payloads, the skill implements an output strategy that saves full responses to local JSON files and only prints summaries to the agent's context unless explicitly overridden. This is a recognized safety pattern for data-intensive tools.
- [DYNAMIC_EXECUTION]: The onboarding script utilizes the qrcode library to generate and render payment QR codes as both image files and ASCII art. This functionality is restricted to the specific purpose of account management and does not involve arbitrary or unsafe code generation at runtime.
Audit Metadata