linkfox-temu-returns-refunds-us

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's auth examples and usage require embedding API keys/accessTokens in request headers or command-line JSON arguments and may print full JSON responses to stdout, which forces the LLM to handle and potentially output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Required workflow calls Temu gateway APIs at runtime and then prints/summarizes the gateway’s JSON response (outsider-authored content) into stdout, which the agent can ingest into the LLM context; see emit_result() in scripts/_temu_common.py where print(serialized) or _lf_summarize(result) outputs response-derived text.