linkfox-temu-returns-refunds-eu

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 本 skill 在运行时通过 scripts/eu_returns_refunds_* 将用户提供的 request/业务参数传给网关 POST /temu/proxy 并解析其 body 为 result，而该 result 会被摘要或完整 JSON 写入磁盘并打印到 stdout，因此第三方可在其返回字段（如 afterSalesReasonDesc/buyerComment 等）中注入自由文本并被 LLM 读取。

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for "Returns & Refunds" (退货与退款) and exposes a built-in gateway (eu_returns_refunds_*, POST https://tool-gateway.linkfox.com/temu/proxy) and multiple aftersales/returns-related API scripts. This indicates it is specifically designed to interact with partner refund-related APIs (i.e., issuing or managing refunds via Temu partner endpoints), which constitutes direct financial execution authority.