linkfox-echotik-list-new-product-rank
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by running local Python scripts,
scripts/echotik_list_new_product_rank.pyandscripts/onboarding.py, which are used to interface with the EchoTik API and handle user authentication tasks. - [EXTERNAL_DOWNLOADS]: The
scripts/onboarding.pyscript relies on and suggests the installation of well-known, legitimate Python packages includingrequests,qrcode, andpillowto enable its core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the external EchoTik API, which introduces a theoretical surface for indirect prompt injection if retrieved product names or metadata contain adversarial instructions.
- Ingestion points: Data enters the environment via the
/echotik/listNewProductRankAPI endpoint as handled inscripts/echotik_list_new_product_rank.py. - Boundary markers: There are no explicit delimiters or boundary instructions implemented in the script to separate external content from the agent's logic.
- Capability inventory: The skill scripts are capable of executing local commands, writing to a
linkfoxsubdirectory within the project, and initiating network requests to the vendor's API domains. - Sanitization: The skill does not perform specific validation or sanitization of the remote API response before presenting it to the agent context.
Audit Metadata