linkfox-keepa-product-request
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes Amazon product metadata (such as titles, brands, and specifications) retrieved from the Keepa API. This external data enters the agent context when results are displayed to the user. The risk is mitigated by instructions to use structured tables and the API's exclusion of high-risk content like product reviews and descriptions.
- Ingestion points: API responses from
keepa/productRequestcontaining product titles and attributes. - Boundary markers: The skill instructs the agent to use well-structured tables and group related fields.
- Capability inventory: Execution of local scripts and writing of JSON data logs to the workspace.
- Sanitization: Standard JSON parsing is performed by the utility scripts before data is provided to the agent.
- [COMMAND_EXECUTION]: The skill uses local Python scripts (
scripts/keepa_product_detail.pyandscripts/onboarding.py) to perform its primary functions. These scripts are invoked with JSON parameters to communicate with the vendor's API gateway. - [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with vendor-controlled domains (
*.linkfox.com) for retrieving product data, performing user authentication, and handling billing functionality. - [PERSISTENCE_MECHANISMS]: The onboarding documentation provides instructions for users to persist their API keys by adding export commands to their shell configuration files (e.g.,
.zshrc,.bashrc). This is a standard practice for CLI-based tools to maintain configuration across sessions.
Audit Metadata