linkfox-maidalv-product-tro-detection
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to interact with the LinkFox API and manage local image uploads. These scripts (
maidalv_check_api_flash.py,upload_image.py, andonboarding.py) are executed via shell commands. The operations include sending HTTP requests to vendor-owned domains and handling local file reading for uploads, which are consistent with the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The skill downloads and manages images for IP risk detection. Specifically,
upload_image.pyfacilitates uploading local images to a presigned URL ontool-gateway.linkfox.com(a vendor domain) to obtain a public URL for the main detection API. This is a standard functional requirement for processing local files in a cloud-based detection environment. - [DATA_EXPOSURE]: The skill handles product images and metadata which are sent to the LinkFox API for analysis. It also manages user credentials (API keys) stored in environment variables (
LINKFOX_AGENT_API_KEY). Theonboarding.pyscript assists users in obtaining and setting these keys securely via a login process. There is no evidence of these credentials being exfiltrated to non-vendor domains.
Audit Metadata