linkfox-amazon-store-report

SUSPICIOUS. The core behavior matches an Amazon report automation skill, and the named dependency appears to come from the same LinkFox publisher, so this is not fundamentally incompatible with its stated purpose. However, the skill installs/depends on another skill, routes report operations through LinkFox’s proxy instead of direct Amazon endpoints, persists full report data locally, and opens a temporary local HTTP server. These are coherent but broaden trust and data-exposure scope enough to warrant caution rather than a benign rating.

The code implements a report retrieval workflow and does not contain clear malware such as persistence, destructive behavior, reverse shells, cryptomining, or broad system-data theft. Its main security concerns are trust in the configurable LinkFox gateway, transmission of an environment-held API key and seller data to that gateway, unrestricted use of the gateway-provided download URL, execution of an unshown dependency checker, and possible report exposure when serveHost is configured to a non-loopback address. The default local server binding is comparatively safer. Review the gateway, dependency checker, and deployment configuration before use.