linkfox-ruiguan-gun-parts-search
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform network requests, file uploads, and onboarding tasks. These scripts are invoked via standard CLI patterns (e.g.,
python scripts/upload_image.py). The commands are restricted to the skill's specific purpose and do not involve arbitrary shell injection or dangerous system modifications. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to vendor-controlled domains (
tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com,skill-api.linkfox.com) for API services, authentication, and image uploads. These are legitimate vendor resources for the skill author 'linkfox-ai'. - [DATA_EXPOSURE]: The skill reads product images and session metadata, storing results in a local
linkfox/directory. It requires an API key for authentication, which is managed via environment variables (LINKFOX_AGENT_API_KEY). The onboarding process handles credential acquisition and billing through official vendor channels. No sensitive local system data (like SSH keys or AWS credentials) is accessed. - [INDIRECT_PROMPT_INJECTION]: The skill processes external image URLs provided by the user. While these inputs enter the agent's context, the skill uses these URLs solely for visual similarity search via an API. There is no evidence of the agent executing instructions embedded within the metadata or content of these images. Sanitization is handled by the visual search API on the backend.
Audit Metadata