linkfox-temu-order-global

SUSPICIOUS: the skill’s purpose and requested credentials broadly match Temu order management, and there is no install-time malware pattern. The main risk is data-flow integrity: sensitive Temu tokens and order/shipping data are routed through LinkFox gateway endpoints and saved locally by default, while public verification of the gateway’s behavior is limited. This looks like a plausible vendor integration with elevated proxy/privacy risk rather than confirmed malware.

The fragment does not show clear malicious intent. It implements an API gateway client and local result persistence, but it handles sensitive authentication tokens and sends them to an environment-configurable endpoint. The direct use of SESSION_ID in a filesystem path creates a plausible path traversal/write-location risk, and full API responses may be stored without restrictive permissions. Review gateway configuration, sanitize SESSION_ID, constrain output paths, and inspect _temu_token_store and callers before deployment.