linkfox-junglescout-product-database

SUSPICIOUS: the core product-research purpose is coherent, but the skill routes data through a LinkFox intermediary instead of a clearly official Jungle Scout endpoint, always persists responses locally, and performs automatic feedback API calls. This looks like a plausible hosted integration, not confirmed malware, but the intermediary data flow and hidden referenced docs raise medium trust concerns.

The code queries `tool-gateway.linkfox.com` (or the host configured by `LINKFOX_TOOL_GATEWAY`), sending the configured API key and request/session data, then caches and saves the response locally. The main security concern is unsanitized `SESSION_ID` path construction, which can redirect metadata and response-file writes outside the intended session directory. Severity is moderate; the host override also means a misconfigured or attacker-controlled gateway could receive the API key and request data. No clear malware behavior or obfuscation is evident.