linkfox-temu-promotion-eu

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes an explicit example passing an accessToken inside a command-line JSON argument (and shows exporting API keys inline), which encourages embedding secret values verbatim in commands/requests that the LLM would need to output.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 的运行路径会读取调用方在参数中提供的自由文本（JSON 里的 params/request 等）并在 _temu_common.call_temu_api() 里直接序列化后经 POST /temu/proxy/POST /temu/fileDownload 发往网关（例如 scripts/eu_promotion_activity_candidate_goods_query.py → _eu_promotion_script.run_cli → _temu_eu_common.eu_proxy_call → call_temu_api(PROXY_URL, body, ...)）。