linkfox-jiimore-get-niche-review-from-keyword

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The line pointing to https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip instructs downloading and installing an unknown ZIP (an executable distribution vector) which is a common malware delivery pattern and therefore suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text can enter the LLM context via the tool/API response fields (notably data[].reviewExample and other string fields) returned by the external Jiimore endpoint at runtime, and the script prints JSON/summary to stdout (which the agent can ingest), with --inline forcing full unfiltered output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs at runtime to download and install an onboarding ZIP that would add/replace skill code and directives (https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip), so fetched content can directly control agent behavior.