linkfox-sellersprite-traffic-keyword
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages authentication using the
LINKFOX_AGENT_API_KEYenvironment variable. The provided onboarding script assists users in retrieving their API key from the vendor's platform and provides instructions for local configuration. - [EXTERNAL_DOWNLOADS]: The skill communicates with vendor-controlled endpoints including
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.comfor data retrieval and account management. It also recommends the installation of standard Python packages likerequestsandqrcodefor extended functionality. - [COMMAND_EXECUTION]: Python scripts are used to process ASIN queries and facilitate the login flow. These scripts parse JSON input to structure API requests but do not perform arbitrary command execution.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves traffic data from external APIs and incorporates it into the agent's context. The data is saved to local JSON files in the
linkfox/directory for persistence and further analysis using tools likejq. - [PERSISTENCE]: The onboarding documentation provides instructions for users to manually append export commands to shell profiles (e.g.,
.zshrc,.bashrc) to maintain API key availability across terminal sessions. - [DYNAMIC_EXECUTION]: The execution scripts utilize dynamic path insertion to load shared vendor-provided utilities from the local file system.
Audit Metadata