linkfox-amazon-store-catalog

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in _spapi_catalog_common.py to execute its own internal dependency checker script (check_auth_dependency.py). This is a functional component used to verify the presence of required authentication skills and does not facilitate arbitrary shell command execution.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with verified vendor-owned API domains, including tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com. These connections are necessary for the skill's primary functionality, such as proxying Amazon SP-API requests and handling account onboarding.
  • [DATA_EXFILTRATION]: API responses containing Amazon catalog data are saved to a local linkfox directory within the user's project or home folder. This behavior is documented in the skill instructions and is intended to allow the agent to process data efficiently without exceeding context window limits.
  • [CREDENTIALS_UNSAFE]: The onboarding.py script contains a hardcoded Base64-encoded string (_LOGIN_FIXED_UID). Analysis confirms this string decodes to a public application identifier used for the vendor's login service and does not represent a sensitive user credential or secret key.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 07:03 AM
Security Audit — agent-trust-hub — linkfox-amazon-store-catalog