linkfox-temu-promotion-global

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes examples and CLI usage that embed secrets verbatim (export LINE with LINKFOXAGENT_API_KEY and a python command that takes a JSON containing "accessToken"), which would require an LLM to place actual API keys/tokens into generated commands or code, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Temu Global Promotion 的运行时会把网关返回的 body（Temu 原始 JSON 字符串，可包含 activityName/failReason 等 free-text）解析后并通过 emit_result() 写入文件/打印摘要，因此输出内容会包含上游（Temu/Partner）可注入的文本，但它不是由“外部用户在该工作流中先选择 specific item 才被读取”的任意自由文本输入通道。