linkfox-amazon-search-by-image

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts to perform core functions, including amazon_search_by_image.py for API interactions and upload_image.py for file processing.
  • [EXTERNAL_DOWNLOADS]: The onboarding.py script recommends the installation of third-party Python libraries such as requests, qrcode, and pillow to enable account management and payment QR code rendering.
  • [DATA_EXFILTRATION]: The upload_image.py script transmits local image files to the vendor's OSS gateway (tool-gateway.linkfox.com) to generate publicly accessible URLs required for the Amazon visual search API. This operation is consistent with the skill's primary purpose of enabling image-based product discovery.
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves product metadata (titles, brands, prices) from various Amazon marketplaces, representing an indirect prompt injection surface as it processes external, untrusted data.
  • Ingestion points: Product details (ASIN, title, brand) are fetched from Amazon marketplaces via the vendor API and processed in amazon_search_by_image.py.
  • Boundary markers: No specific boundary markers or instruction-ignoring warnings are used when presenting the product data.
  • Capability inventory: The skill has permissions for network operations to vendor domains and local file writes within the project's linkfox/ directory.
  • Sanitization: The retrieved product information is presented as returned by the API without additional sanitization filters.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 07:09 AM