linkfox-onboarding
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions include commands for the agent to assist users in setting environment variables. Specifically, it provides shell snippets to append export statements to shell profile files (
~/.zshrc,~/.bashrc) and usesetxon Windows. This behavior is intended for persisting the service's API key. - [EXTERNAL_DOWNLOADS]: The skill utilizes the Python
requestslibrary to communicate with LinkFox API services (api.linkfox.com,tool-gateway.linkfox.com). These domains are official vendor resources used for authentication and account management. - [DATA_EXFILTRATION]: User-sensitive data, including phone numbers and SMS verification codes, are transmitted to the vendor's backend for authentication and registration purposes. Access to the user's API key is also required for billing operations.
- [SAFE]: The Python scripts perform input validation using regular expressions for phone numbers and SMS codes to ensure data integrity before transmission. All network operations are conducted over HTTPS to verified vendor infrastructure.
Audit Metadata