The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Temu API through a proxy gateway, which constitutes an indirect injection surface if the upstream data source is compromised.
Ingestion points: API responses from tool-gateway.linkfox.com are fetched and processed by scripts such as scripts/temu_proxy.py and scripts/us_promotion_activity_query.py.
Boundary markers: None identified. The skill saves raw JSON responses for the agent to read without specific delimiters or warnings against embedded instructions.
Capability inventory: The skill possesses capabilities for network communication (urllib, requests) and file system operations (read/write to project and home directories).
Sanitization: None identified. The skill records complete API responses to disk in their raw format.
[EXTERNAL_DOWNLOADS]: The scripts/onboarding.py utility suggests the manual installation of standard Python packages.
Evidence: The script contains logic to prompt the user to install requests, qrcode, and pillow via pip if they are missing from the environment.
[DATA_EXFILTRATION]: The skill facilitates the transmission of Temu session tokens (accessToken) to the LinkFox proxy gateway.
Evidence: Scripts such as _temu_common.py and temu_proxy.py include the Temu accessToken in the request body sent to https://tool-gateway.linkfox.com/temu/proxy. This is consistent with the skill's stated purpose of providing a managed API gateway for Temu.
[CREDENTIALS_UNSAFE]: The skill manages sensitive credentials including a LinkFox API key and Temu access tokens.
Evidence: The skill stores Temu access tokens in a local JSON file located at ~/.linkfox/temu-access-tokens.json as implemented in scripts/_temu_token_store.py. It also retrieves the LinkFox API key from environment variables like LINKFOX_AGENT_API_KEY.
[COMMAND_EXECUTION]: The onboarding documentation provides instructions for users to manually configure their environment.
Evidence: references/onboarding.md instructs users on how to use setx (Windows) or update shell profiles (.zshrc, .bashrc on Unix-like systems) to persist the LinkFox API key.

linkfox-temu-promotion-us