The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements a local credential storage mechanism to persist Temu access tokens.\n
Evidence: The file scripts/_temu_token_store.py manages a JSON store at ~/.linkfox/temu-access-tokens.json. This file contains sensitive accessToken values and is accessed by the skill's proxy scripts to authenticate requests to the Temu platform.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of several third-party Python libraries to support its full functionality.\n
Evidence: The scripts/onboarding.py script and the references/onboarding.md documentation instruct the user to install the requests, qrcode, and pillow packages. These dependencies are used for account login workflows and generating payment QR codes.\n- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection (Category 8) by processing untrusted data from the Temu API.\n
Ingestion points: The skill fetches external data from the Temu API using urllib.request.urlopen in the call_temu_api function located in scripts/_temu_common.py.\n
Boundary markers: The instructions do not specify any boundary markers or delimiters to isolate API response data or warn the agent against executing embedded instructions.\n
Capability inventory: The skill possesses capabilities for network communication and writing to the local filesystem (via the emit_result function in scripts/_temu_common.py).\n
Sanitization: The skill relies on standard JSON parsing and does not implement specific sanitization or filtering to prevent malicious content in API responses from influencing agent behavior.

linkfox-temu-promotion-us