linkfox-etsy-product-detail

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes Python scripts (scripts/etsy_product_detail.py and scripts/onboarding.py) to handle product data retrieval and account onboarding workflows. These scripts are self-contained and perform standard operations such as API calls and local file storage for session data.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to official LinkFox domains (tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com) for its core functionality, including data fetching, user authentication, and billing services. These interactions are consistent with the skill's stated purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Etsy listing URLs, which represents a potential injection surface.
  • Ingestion points: Data is fetched from public Etsy listing pages via scripts/etsy_product_detail.py.
  • Boundary markers: The script manages data by saving the full response to a JSON file and providing a summary to the agent, which limits the direct processing of potentially malicious content.
  • Capability inventory: The skill includes file writing (to the local linkfox/ directory) and network access to vendor-specified endpoints.
  • Sanitization: The script uses JSON parsing and enforces size limits on the summary provided to the stdout, ensuring that large or complex payloads are summarized rather than fully rendered in the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:11 AM