linkfox-sellersprite-traffic-keyword

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill manages authentication using the LINKFOX_AGENT_API_KEY environment variable. The provided onboarding script assists users in retrieving their API key from the vendor's platform and provides instructions for local configuration.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with vendor-controlled endpoints including tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com for data retrieval and account management. It also recommends the installation of standard Python packages like requests and qrcode for extended functionality.
  • [COMMAND_EXECUTION]: Python scripts are used to process ASIN queries and facilitate the login flow. These scripts parse JSON input to structure API requests but do not perform arbitrary command execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves traffic data from external APIs and incorporates it into the agent's context. The data is saved to local JSON files in the linkfox/ directory for persistence and further analysis using tools like jq.
  • [PERSISTENCE]: The onboarding documentation provides instructions for users to manually append export commands to shell profiles (e.g., .zshrc, .bashrc) to maintain API key availability across terminal sessions.
  • [DYNAMIC_EXECUTION]: The execution scripts utilize dynamic path insertion to load shared vendor-provided utilities from the local file system.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:11 AM