linkfox-google-trend-get-trend-by-keys
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied keywords and external data from the Google Trends API. It has an ingestion point in the keyword parameter and API response, lacks explicit boundary markers to delimit untrusted data, and provides network and file-writing capabilities through its scripts. While keyword length is limited, the absence of sanitization for API outputs creates a surface for potential indirect prompt injection.
- [DATA_EXPOSURE]: The skill's onboarding script handles sensitive user information, including phone numbers and authentication codes. These data points are transmitted to official vendor subdomains (api.linkfox.com) for authentication. The script also displays retrieved API keys to the user for environment configuration.
- [PERSISTENCE]: The documentation provides manual instructions for users to persist API keys in shell profiles (~/.zshrc or ~/.bashrc). This setup is intended for cross-session functionality and is not executed automatically by the skill's code.
- [COMMAND_EXECUTION]: The skill requires the execution of Python scripts to interact with the LinkFox gateway and manage local data caching. These scripts perform network operations and file writes within the project's working directory.
Audit Metadata