linkfox-temu-price-eu

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill documentation includes examples that embed Temu accessToken/storeKey directly in command-line JSON (and instruct passing them into scripts), which would require an LLM to place secret values verbatim into generated commands/requests, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). 该 skill 在运行时会调用 Temu 网关 /temu/proxy，将网关返回的 body（其中包含 Temu 原始 JSON 字符串/解析后的字段与 errorMsg 等文本）通过 emit_result() 直接打印摘要/完整 JSON，从而把“outsider（Temu/网关上游）返回的自由文本”喂入到 LLM 上下文（若上层把 stdout 作为上下文）。