linkfox-kalodata-tiktok-product
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns such as prompt injection, obfuscation, or unauthorized data exfiltration were detected. The skill's behavior aligns with its stated purpose of TikTok product research.\n- [COMMAND_EXECUTION]: The skill utilizes local Python scripts (
scripts/kalodata_product_search.py,scripts/kalodata_product_detail.py, andscripts/onboarding.py) to process user requests and interface with vendor APIs. These scripts are invoked with JSON-formatted arguments and support local caching.\n- [EXTERNAL_DOWNLOADS]: The scripts perform network requests to recognized vendor domains (tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com, andskill-api.linkfox.com) for data retrieval and user authentication. Theonboarding.pyscript also provides instructions for installing common Python packages (requests,qrcode,pillow) if they are missing from the environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API sources.\n - Ingestion points: Product ranking and detail data are ingested through the Kalodata API endpoints described in
references/api.md.\n - Boundary markers: Data is handled as structured JSON; no explicit prompt delimiters are defined for the final output stage.\n
- Capability inventory: The skill has the capability to write JSON response data and session metadata to the local
linkfox/workspace directory and perform network calls to vendor-controlled domains.\n - Sanitization: The scripts parse API responses as JSON, and the instructions recommend using tools like
jqto extract specific fields rather than injecting entire payloads into the prompt context.
Audit Metadata