linkfox-echotik-list-new-product-rank
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform API calls and handle user onboarding. The
onboarding.pyscript executes shell commands to help users set environment variables for API keys across different operating systems (Windowssetx, macOS/Linuxecho >> ~/.zshrc). These are documented user-initiated actions for configuration. - [EXTERNAL_DOWNLOADS]: The skill communicates with
linkfox.comandlinkfox-ai.comdomains (and subdomains) to fetch product data and manage user authentication/billing. These are legitimate vendor resources for the skill's stated purpose. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads API keys from environment variables (
LINKFOX_AGENT_API_KEY,LINKFOXAGENT_API_KEY) and transmits them in the Authorization header to the vendor's gateway. This is standard API authentication behavior and does not target sensitive system files like SSH keys or AWS credentials. - [REMOTE_CODE_EXECUTION]: No patterns of remote script piping (e.g.,
curl | bash) or dynamic execution of untrusted remote code were detected. All executable logic is contained within the provided local scripts.
Audit Metadata