linkfox-temu-manage-product-us

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes examples and usage that instruct embedding API keys/accessTokens directly in command-line/Python invocation and mapping LINKFOX API keys into Authorization headers, which would require the agent to handle or output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 通过 scripts/_temu_common.py:call_temu_api() 使用用户在运行时传入的 JSON（可包含自由文本字段如 searchText/url 等）直接构造网关请求体并把网关响应（含 body 字符串）解析进内存/落盘：/temu/proxy（scripts/_temu_us_common.py）读取并 emit_result() 处理响应。