linkfox-amazon-alexa-search

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The list includes a direct download link to a ZIP archive (https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip) instructed to be downloaded and installed—direct archive downloads for installing executables from a project file host are a high-risk distribution vector that can carry malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested from the upstream Alexa shopping API response (stdout/data[*].content/followUpQuestions) and then printed/returned by the script, which becomes LLM-visible context; this is not user-authored and is effectively third-party generated text.