linkfox-1688-product-detail
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts (
alibaba1688_product_detail.pyandonboarding.py) to interact with the LinkFox API. These scripts perform standard network operations to fetch product data and manage user authentication. - [EXTERNAL_DOWNLOADS]: The scripts communicate with official LinkFox API endpoints (
tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com) to retrieve product information and handle user logins. These are functional requirements for the skill's purpose. - [CREDENTIALS_SAFE]: The skill manages API keys through environment variables (
LINKFOX_AGENT_API_KEY,LINKFOXAGENT_API_KEY). It does not hardcode any sensitive credentials and includes an onboarding script to help users securely set up their own keys. - [DATA_EXPOSURE]: The skill saves query results locally within a
linkfox/directory in the user's workspace for session persistence and caching. It explicitly avoids using shared temporary directories like/tmpto maintain data isolation. - [INDIRECT_PROMPT_INJECTION]: The skill processes 1688 product data including titles and descriptions which may contain HTML. The instructions include a specific rule to treat HTML as data and summarize or extract media links rather than rendering it, which serves as a mitigation against potential injection through product content.
Audit Metadata