linkfox-sellersprite-market-research

This code implements a market-research API client that sends command-line JSON parameters and an API key from `LINKFOX_AGENT_API_KEY` or `LINKFOXAGENT_API_KEY` to `https://tool-gateway.linkfox.com` by default, then caches and saves the response locally. The configurable `LINKFOX_TOOL_GATEWAY` can redirect requests and expose the API key if set to an untrusted endpoint. Unvalidated `SESSION_ID` values can cause session metadata and response files to be written outside the intended directory. Severity is moderate due to these configuration-dependent credential disclosure and path-traversal risks; the fragment does not otherwise show clear malicious behavior.