linkfox-amazon-store-catalog
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runin_spapi_catalog_common.pyto execute its own internal dependency checker script (check_auth_dependency.py). This is a functional component used to verify the presence of required authentication skills and does not facilitate arbitrary shell command execution. - [EXTERNAL_DOWNLOADS]: The skill communicates with verified vendor-owned API domains, including
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.com. These connections are necessary for the skill's primary functionality, such as proxying Amazon SP-API requests and handling account onboarding. - [DATA_EXFILTRATION]: API responses containing Amazon catalog data are saved to a local
linkfoxdirectory within the user's project or home folder. This behavior is documented in the skill instructions and is intended to allow the agent to process data efficiently without exceeding context window limits. - [CREDENTIALS_UNSAFE]: The
onboarding.pyscript contains a hardcoded Base64-encoded string (_LOGIN_FIXED_UID). Analysis confirms this string decodes to a public application identifier used for the vendor's login service and does not represent a sensitive user credential or secret key.
Audit Metadata