The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill scripts perform network operations to communicate with the LinkFox vendor's official domains (tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com). These connections are used to fetch marketplace data, manage user authentication, and process billing requests, which is consistent with the skill's primary purpose.
[DATA_EXFILTRATION]: The scripts transmit session-related metadata (such as SESSION_ID, MESSAGE_ID, and APP_NAME) and user-provided authentication information (API keys, phone numbers for verification) to the vendor's API endpoints. This telemetry and data handling are standard for service-based integrations and are explicitly documented within the skill's reference files.
[COMMAND_EXECUTION]: The skill uses Python scripts to perform structured data retrieval and manage the onboarding process. The execution is limited to pre-defined logic within the scripts, and no arbitrary shell command execution was observed.
[CREDENTIALS_UNSAFE]: The skill manages authentication using API keys stored in environment variables (LINKFOX_AGENT_API_KEY). It includes clear instructions and an onboarding script to help users securely configure these credentials without revealing them to the agent context directly.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from Mercado Libre.
Ingestion points: The call_api function in scripts/linkfox_mercado_product_selection.py retrieves marketplace content.
Boundary markers: The skill instructs the agent to present data without inventing conclusions and provides specific display rules in SKILL.md.
Capability inventory: The scripts can write JSON response files to a local linkfox/ directory and perform HTTP POST/GET requests to vendor domains.
Sanitization: Content is parsed as JSON before being presented to the agent, reducing the risk of raw instruction injection from source data.

linkfox-mercado-product-selection