linkfox-temu-returns-refunds-us

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill linkfox-temu-returns-refunds-us 在运行时通过 scripts/temu_us_proxy.py/scripts/temu_us_file_download.py 将用户提供的 JSON（params/url）直接发送到 POST https://tool-gateway.linkfox.com/temu/proxy 或 /temu/fileDownload，并把网关返回的 body 解析为可读 JSON 再落盘/摘要输出；其中 params.request/type 等字段允许包含由外部用户“自由文本”构造的数据进入请求体。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill and referenced scripts for literal, high-entropy credentials. Most token-like values in examples are placeholders (e.g., "", "TOKEN", "PASTE_TOKEN_HERE") and were ignored per the rules.

One literal high-entropy value was found in scripts/onboarding.py: the _LOGIN_FIXED_UID default ("eyJhX2lkIjoiNmEyMmM4YjA1YmM5MTZhIiwiZF9pZCI6IiJ9") is a base64-url string (JWT-like payload) and the surrounding comment says it is a "fixed uid header (tested usable)" for the login flow. That makes it a literal, non-placeholder token which could be used in the login/auth chain, so I treat it as a secret and flag it.

All other tokens in the files are placeholders or masked examples and therefore not flagged (e.g., export LINKFOXAGENT_API_KEY="", "TOKEN", "PASTE_TOKEN", masked tokens shown by scripts).

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). 本 skill 明确以“退货与退款（Returns & Refunds）”为主要功能（标题与描述多次强调），并暴露了专用的 OpenAPI 名称/网关（us_returns_refunds_*、temu_us_proxy 等）以及可通过 POST /temu/proxy 发起不同操作的代理接口。该套接口/脚本组专门用于 Partner 的售后/退款场景，属于专门用于发起退款类操作的能力（即可能直接触发资金回退/退款事务），因此应视为具有直接金融执行能力。