linkfox-echotik-list-new-product-rank

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill operates by running local Python scripts, scripts/echotik_list_new_product_rank.py and scripts/onboarding.py, which are used to interface with the EchoTik API and handle user authentication tasks.
  • [EXTERNAL_DOWNLOADS]: The scripts/onboarding.py script relies on and suggests the installation of well-known, legitimate Python packages including requests, qrcode, and pillow to enable its core functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from the external EchoTik API, which introduces a theoretical surface for indirect prompt injection if retrieved product names or metadata contain adversarial instructions.
  • Ingestion points: Data enters the environment via the /echotik/listNewProductRank API endpoint as handled in scripts/echotik_list_new_product_rank.py.
  • Boundary markers: There are no explicit delimiters or boundary instructions implemented in the script to separate external content from the agent's logic.
  • Capability inventory: The skill scripts are capable of executing local commands, writing to a linkfox subdirectory within the project, and initiating network requests to the vendor's API domains.
  • Sanitization: The skill does not perform specific validation or sanitization of the remote API response before presenting it to the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:11 AM