linkfox-temu-order-eu

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 的运行时会读取“用户/调用者在 CLI 里提供的 JSON 参数字符串”，并在 extract_business_params() 中把除保留字段外的任意键值当作 params 转发到 POST https://tool-gateway.linkfox.com/temu/proxy（从而让 LLM 处理/摘要化该文本输入，存在间接 prompt 注入面）；路径为 scripts/eu_order_* → _eu_order_script.run_cli → load_json_arg → run_and_print → emit_result。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I found one literal value that looks like a fixed, encoded header token which may function as an authentication/identity header and therefore could be a credential:
• scripts/onboarding.py lines [48–50] define _LOGIN_FIXED_UID with a base64url-like string ("eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9"). The surrounding comments state this is a "登录链路固定 uid header（实测可用）" (login chain fixed uid header, tested usable), which suggests it is used in requests as a fixed UID header. That matches the definition of a secret (a literal token-like value that may grant or spoof access), so I flagged it.

I ignored many obvious placeholders and examples (e.g., "", "TOKEN", "PASTE_TOKEN_HERE", environment variable names like LINKFOXAGENT_API_KEY, or example/export lines) because they are documentation placeholders or sample values per the allowed ignores. I also did not flag menu_code/sub_menu_code hex identifiers in docs since those are documentation/resource identifiers (not clearly usable credentials) and are common non-secret IDs.