The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with Amazon SP-API via the vendor's infrastructure.
It communicates with tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com for API proxying and account management functions in _spapi_fba_common.py and onboarding.py.
These domains are verified vendor resources belonging to linkfox-ai and represent standard functionality for the skill's purpose.
[COMMAND_EXECUTION]: The skill executes a local script to verify environment dependencies.
In _spapi_fba_common.py, subprocess.run is used to execute check_auth_dependency.py using the current Python interpreter (sys.executable). This is a benign internal check to ensure the required authentication skill is installed.
[INDIRECT_PROMPT_INJECTION]: The skill processes data returned from external Amazon SP-API calls, which serves as an ingestion point for untrusted data.
Ingestion points: API responses processed in _fba_runner.py and _spapi_fba_common.py (specifically the payload field).
Boundary markers: Not present; the skill relies on the structured JSON nature of the API responses.
Capability inventory: The skill has capabilities to write data to the local filesystem (in the linkfox/ directory) and perform network requests to the vendor gateway.
Sanitization: Standard JSON parsing is performed, but no specific prompt-level sanitization is applied to the ingested data before it is presented to the agent. The risk is considered low given the highly structured nature of FBA business data.

linkfox-amazon-store-fba