linkfox-amazon-ads-report
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The main report retrieval script,
scripts/get_report.py, executesscripts/check_auth_dependency.pyusing thesubprocessmodule. This is used to verify that the required authentication skill is installed in the local environment, ensuring proper system modularity and dependency management. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to communicate with the Amazon Advertising API (facilitated by the
tool-gateway.linkfox.comproxy) and vendor services onlinkfox.comsubdomains for account management and order processing. These downloads are restricted to functional data and traceable vendor infrastructure. - [OBFUSCATION]: The script
scripts/onboarding.pycontains a base64-encoded string (_LOGIN_FIXED_UID). Detailed analysis shows this decodes to a static JSON object containing benign metadata used for service identification, presenting no security threat. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Amazon Ads reports into the agent's context. While this is an untrusted data surface, the skill implements safe handling by downloading files to temporary directories and providing structured JSON previews, minimizing the risk of unauthorized instruction execution.
Audit Metadata