Security audit
Security checks across malware telemetry and agentic risk
The skill’s Shopee research purpose is coherent, but it stores paid API credentials and reusable tokens in plaintext and caches review data without enough security or privacy guidance.
Review this before installing on any shared or sensitive machine. It will use a paid Shopdora account, store credentials and tokens under `~/.shopdora`, make external API calls, and cache result data locally. Use least-privilege API credentials where possible, restrict file permissions, rotate secrets if exposed, clear cached review data when no longer needed, and avoid collecting or exporting personal review data unless you have a valid business need and legal basis.
**Token renewal rules:** - Token is valid for ~31 days; re-acquire before expiration - When any API returns `9990`, automatically delete `token.json`, re-acquire the token, and retry the original request - Check the `tokenExpiresIn` field from `/standard/queryBalance` for the precise expiration time ---
1. First, attempt to read `~/.shopdora/token.json` 2. If the file exists, check if `obtainedAt + expiresIn > current timestamp`; use directly if valid 3. If the file doesn't exist or has expired, read credentials from `~/.shopdora/config.json` and call the token endpoint 4. Write the new token and acquisition time to `~/.shopdora/token.json` 5. All subsequent API requests read accessToken from `token.json` **API call:**
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
