linkfox-junglescout-keyword-by-keyword
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
junglescout_keyword_by_keyword.pyandonboarding.py) to handle API requests and user account management tasks. - [EXTERNAL_DOWNLOADS]: The onboarding documentation recommends installing well-known Python packages such as
requests,qrcode, andpillowto support network operations and QR code rendering. - [INDIRECT_PROMPT_INJECTION]: The skill ingests keyword data from external APIs, which creates a potential surface for indirect injection if the source data were compromised.
- Ingestion points: Data is fetched from
tool-gateway.linkfox.comand processed through thekeywordInfoListarray. - Boundary markers: The instructions do not define explicit delimiters to isolate external API data when it is presented in the final response.
- Capability inventory: The skill can write JSON results and metadata to the local file system and perform network requests to LinkFox API endpoints.
- Sanitization: The scripts use standard JSON parsing for API responses without implementing additional content filtering for the retrieved keyword strings.
- [PERSISTENCE]: The onboarding documentation provides manual instructions for users to persist their API keys by adding them to shell configuration files (e.g.,
.bashrc,.zshrc) or using thesetxcommand on Windows systems.
Audit Metadata