linkfox-fastmoss-product-rank-top-selling
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts (
scripts/fastmoss_product_rank_top_selling.pyandscripts/onboarding.py) to perform API calls and manage user accounts. These scripts use standard libraries for network requests and data processing. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
tool-gateway.linkfox.comandapi.linkfox.com, which are official domains associated with the skill's vendor (linkfox-ai). These interactions are part of the skill's core functionality. - [CREDENTIALS_UNSAFE]: The skill provides clear instructions and scripts for managing API keys using environment variables (
LINKFOX_AGENT_API_KEY). It includes an onboarding script to help users obtain their own keys securely rather than using hardcoded secrets. - [DATA_EXFILTRATION]: While the skill communicates with external APIs, these are authorized endpoints for the service. Data is saved locally in a structured
linkfox/directory within the project workspace, adhering to session-based organization without writing to sensitive system paths like/tmp. - [PERSISTENCE_MECHANISMS]: The onboarding documentation suggests standard, non-malicious methods for users to persist their API keys in their own shell profiles (e.g.,
.bashrc,.zshrc) for convenience, which is standard developer practice.
Audit Metadata