linkfox-chuhaijiang-tiktok-shop
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python scripts to orchestrate API requests and manage local storage for TikTok Shop market intelligence. These scripts handle data caching and structured logging within the project directory.
- [EXTERNAL_DOWNLOADS]: The
onboarding.pyscript identifies third-party Python libraries (requests,qrcode,pillow) as optional dependencies for account management and payment visualization features, instructing the user on how to install them via standard package managers. - [DATA_EXFILTRATION]: The skill facilitates communication with vendor-managed domains (
linkfox.com,linkfox-ai.com) for data retrieval and authentication. The onboarding process involves the transmission of phone numbers to the vendor's authentication service to acquire API tokens, which is the intended functionality for account setup. - [INDIRECT_PROMPT_INJECTION]: The skill processes store intelligence data from external API responses, which represents a potential surface for indirect injection.
- Ingestion points: Data ingested via
chuhaijiang_seller_search.pyand other relationship tracing scripts from API endpoints. - Boundary markers: The skill outputs raw JSON data; it does not implement specific text-based delimiters for content returned from the API.
- Capability inventory: Scripts possess network access to LinkFox gateways and filesystem access to the project's local
linkfox/data directory. - Sanitization: API response content is saved to disk and printed to the console without active filtering or sanitization of field values.
Audit Metadata