linkfox-mpstats-ozon-product-trend

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts (mpstats_ozon_product_trend.py and onboarding.py) to retrieve trend data and handle authentication flows. This behavior is necessary for the skill's documented functionality.
  • [DATA_EXFILTRATION]: The skill transmits parameters and authentication identifiers to several subdomains of linkfox.com (such as tool-gateway.linkfox.com and api.linkfox.com). This communication is directed to the vendor's own infrastructure for legitimate API operations.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests marketplace data from external APIs, which serves as a potential attack surface. However, the data consists of strictly formatted numeric values and dates (e.g., prices, sales counts, inventory levels), which minimizes the risk of executing embedded instructions.
  • Ingestion points: Trend data fetched from the LinkFox gateway in mpstats_ozon_product_trend.py.
  • Boundary markers: No explicit delimiters are used when the data is interpolated into the agent's context.
  • Capability inventory: The skill can write files to the local linkfox/ project directory and perform network POST requests to vendor APIs.
  • Sanitization: API responses are parsed as JSON and processed through specific numeric and string fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 12:11 PM