linkfox-amazon-ads-auth

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/authorize_url.py uses subprocess.run to interact with system clipboard utilities such as clip.exe (Windows), pbcopy (macOS), xclip, xsel, and wl-copy (Linux). This is a functional requirement to ensure that long authorization URLs are not corrupted by terminal line breaks during manual copying by the user.
  • [PERSISTENCE]: The documentation in references/onboarding.md provides instructions for the agent to guide users in persisting their LINKFOX_AGENT_API_KEY by appending export commands to shell profiles like .bashrc and .zshrc. While this modifies startup scripts, it is a standard and transparent method for CLI-based API configuration.
  • [DATA_EXPOSURE]: The skill manages sensitive OAuth credentials but implements a safety layer in scripts/_token_status_output.py. The strip_raw_tokens function is used by scripts to remove accessToken and refreshToken values from data objects before they are passed to the output logging system or returned to the agent's context.
  • [EXTERNAL_DOWNLOADS]: The scripts/onboarding.py script references the requests and qrcode Python libraries. If these are missing, the script provides informative error messages to the user to install them via standard package managers; it does not attempt to execute remote installation scripts or downloads automatically.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:11 AM