linkfox-seerfar-ozon-keyword-mining

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes keyword and product data from external marketplaces which could potentially contain malicious or adversarial content.
  • Ingestion points: External data fields such as query and product title are retrieved via the API and processed in seerfar_ozon_keyword_mining.py.
  • Boundary markers: The skill does not implement specific delimiters or instructions to ignore embedded prompts in the data it processes.
  • Capability inventory: The skill has capabilities to write to the local filesystem and perform network operations via the seerfar_ozon_keyword_mining.py and onboarding.py scripts.
  • Sanitization: No explicit sanitization or filtering is performed on the marketplace content before it is displayed to the user or saved to the disk.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with several domains associated with the vendor for operational purposes.
  • The onboarding.py script makes network requests to api.linkfox.com and agent-api.linkfox.com for authentication and account management.
  • The seerfar_ozon_keyword_mining.py script communicates with tool-gateway.linkfox.com to fetch keyword mining data.
  • [COMMAND_EXECUTION]: Documentation provides guidance for users to manually configure their environment to persist credentials.
  • The onboarding.md file contains instructions for users to use setx on Windows or shell redirection (>>) on macOS and Linux to save the API key into shell profile files such as .zshrc or .bashrc.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 07:02 AM
Security Audit — agent-trust-hub — linkfox-seerfar-ozon-keyword-mining