linkfox-temu-price-us

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's examples and scripts explicitly show/export API keys and include "accessToken" values directly in CLI JSON arguments and describe placing keys into Authorization headers, which would require an LLM to include secret values verbatim in generated commands or code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path scripts/us_price_*.py → _us_price_script.run_cli() → _temu_us_common.us_proxy_call() → call_temu_api() posts to https://tool-gateway.linkfox.com/temu/proxy and then emit_result() prints/summarizes the gateway response (which can include free-text fields like errorMsg/reason/specName) into the LLM context.