The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and summarizes data from the EchoTik API. This external content is untrusted and could theoretically contain malicious instructions designed to manipulate the agent's behavior during data processing or display.
Ingestion points: Product listings and metadata returned by the echotik/listProduct API endpoint.
Boundary markers: The skill instructions do not specify explicit delimiters or "ignore instructions" wrappers for the ingested data.
Capability inventory: The skill can perform network operations and write JSON data to the local workspace.
Sanitization: Data is serialized via standard JSON libraries, but the content is not filtered for prompt-injection patterns.
[EXTERNAL_DOWNLOADS]: The account management script scripts/onboarding.py relies on well-known third-party Python packages (requests, qrcode, and pillow) which must be installed in the environment for full functionality.
[COMMAND_EXECUTION]: The skill documentation in references/onboarding.md provides shell commands for the user to execute (e.g., setx on Windows or export on Unix-like systems) to configure the LINKFOX_AGENT_API_KEY in their environment.
[OBFUSCATION]: The file scripts/onboarding.py contains a hardcoded Base64-encoded string (_LOGIN_FIXED_UID) used as a session identifier. Decoding it reveals a non-malicious JSON object containing metadata (a_id and d_id).

linkfox-echotik-list-product