linkfox-temu-order-global

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 在运行时会将用户提供的 JSON 参数（其中可包含任意 parentOrderSn/orderSn/orderSnList 等自由文本）直接作为网关请求转发给 POST /temu/proxy，随后把 Temu 返回的 body/JSON 原文解析并落盘/摘要输出，因此会读入并暴露上游返回内容给 LLM（间接提示注入面来自“订单/定制内容”字段等可被外部订单数据污染）。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for high-entropy literal values that could be usable credentials. Most token/API examples in the docs are placeholders (e.g., "", "TOKEN", "PASTE_TOKEN_HERE", "your_temu_access_token") and are intentionally ignored per the rules.

I flagged one literal: a base64-url-like string assigned to _LOGIN_FIXED_UID in scripts/onboarding.py. It's a compact, random-looking value (looks like an encoded JWT segment / payload) used as a fixed UID header in the login flow. Because it is a hardcoded, high-entropy literal that may be used in headers for authentication-like requests (not a clear "example" placeholder), I treat it as a potential secret and flag it.

All other candidate values in the repository are placeholders, masked examples, environment variable names, or simple example tokens and were ignored.