The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on two Python scripts (scripts/sellersprite_competitor_lookup.py and scripts/onboarding.py) to handle API requests and account management. These scripts are executed via the command line and take JSON-formatted arguments.
[EXTERNAL_DOWNLOADS]: The scripts/onboarding.py script attempts to import requests and qrcode. If these are not present, it provides instructions to the user to install them via pip. These are well-known libraries used for HTTP requests and generating QR codes for payment.
[DATA_EXFILTRATION]: The skill transmits search parameters (ASINs, keywords, seller names) to vendor-controlled domains including tool-gateway.linkfox.com and api.linkfox.com. This is consistent with the skill's primary purpose of retrieving market data. It also reads the LINKFOX_AGENT_API_KEY from environment variables to authenticate these requests.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted product data from Amazon (such as titles and descriptions) returned by the API.
Ingestion points: API responses processed in scripts/sellersprite_competitor_lookup.py and subsequently displayed to the agent.
Boundary markers: The skill does not implement specific delimiters or instructions to ignore embedded commands within the product data.
Capability inventory: The skill has the ability to write JSON data files to the local filesystem and perform network requests for feedback and data lookup.
Sanitization: There is no evidence of sanitization or filtering of the retrieved product data before it is presented to the agent context.

linkfox-sellersprite-competitor-lookup