linkfox-junglescout-keyword-by-keyword

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts (junglescout_keyword_by_keyword.py and onboarding.py) to handle API requests and user account management tasks.
  • [EXTERNAL_DOWNLOADS]: The onboarding documentation recommends installing well-known Python packages such as requests, qrcode, and pillow to support network operations and QR code rendering.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests keyword data from external APIs, which creates a potential surface for indirect injection if the source data were compromised.
  • Ingestion points: Data is fetched from tool-gateway.linkfox.com and processed through the keywordInfoList array.
  • Boundary markers: The instructions do not define explicit delimiters to isolate external API data when it is presented in the final response.
  • Capability inventory: The skill can write JSON results and metadata to the local file system and perform network requests to LinkFox API endpoints.
  • Sanitization: The scripts use standard JSON parsing for API responses without implementing additional content filtering for the retrieved keyword strings.
  • [PERSISTENCE]: The onboarding documentation provides manual instructions for users to persist their API keys by adding them to shell configuration files (e.g., .bashrc, .zshrc) or using the setx command on Windows systems.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:11 AM