linkfox-jiimore-get-niche-info-by-keyword
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text data from external Amazon niche listings which presents a potential indirect prompt injection surface.
- Ingestion points: Market segment data, including user-visible text strings like
nicheTitleandtranslationZh, is fetched from the remote LinkFox API gateway insidescripts/jiimore_get_niche_info_by_keyword.pyand processed into the agent's active context. - Boundary markers: There are no specific boundary markers or delimiters defined in
SKILL.mdto segregate data fields from system instructions during rendering. - Capability inventory: The skill possesses file-writing capabilities to cache responses and save structured JSON reports inside the project's local workspace under the
linkfox/directory. - Sanitization: Text fields returned by the third-party marketplace API are printed directly to stdout or saved to disk without explicit character filtering or instruction sanitization.
Audit Metadata