The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages Temu access tokens by storing them in a local JSON file located at ~/.linkfox/temu-access-tokens.json and retrieving them through the scripts/_temu_token_store.py module. It also utilizes the LINKFOXAGENT_API_KEY or LINKFOX_AGENT_API_KEY environment variables to authenticate requests with the LinkFox tool gateway.
[DATA_EXFILTRATION]: The skill performs network operations using urllib.request to communicate with vendor-owned domains, including tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com. These endpoints are used to proxy ecommerce API requests and manage user registration and billing workflows.
[PERSISTENCE]: The skill's onboarding documentation (references/onboarding.md) provides manual instructions for the user to store their LinkFox API key permanently by appending export commands to shell profile files such as ~/.zshrc or ~/.bashrc.
[EXTERNAL_DOWNLOADS]: The scripts/onboarding.py utility suggests the installation of third-party Python packages, specifically requests, qrcode, and pillow, to support its login and QR code rendering capabilities.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: External data is ingested from Temu API responses via the LinkFox gateway in scripts/_temu_common.py and subsequently presented to the agent context.
Boundary markers: The skill does not implement explicit boundary markers or "ignore embedded instructions" warnings when summarizing or logging API response data.
Capability inventory: The skill possesses capabilities to write files to the local project directory and perform outbound network requests.
Sanitization: While data is parsed as structured JSON, the skill does not include specific sanitization or filtering to prevent natural language instructions embedded within API fields (such as product names, buyer comments, or reason descriptions) from influencing the agent's behavior.

linkfox-temu-returns-refunds-us