linkfox-shopee-store-account-health
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
_shopee_account_health_common.pyusessubprocess.runto execute a local Python script (check_auth_dependency.py). This is used to verify that the required authentication skill is installed in the agent's environment before proceeding with API calls. - [EXTERNAL_DOWNLOADS]: The skill interacts with official vendor subdomains (
linkfox.com) to proxy requests to the Shopee Open API and to handle user onboarding. Theonboarding.pyutility also downloads and generates QR codes for payment processing within the vendor's ecosystem. - [DATA_EXPOSURE_EXFILTRATION]: The skill retrieves e-commerce store performance data from Shopee. This data is logged to the local filesystem in a structured directory (
linkfox/<date>/<session>/data/) for user inspection and is transmitted through the vendor's proxy gateway as part of its primary functionality. - [SAFE]: Credentials such as API keys are managed via environment variables (
LINKFOX_AGENT_API_KEY), avoiding hardcoded secrets. The onboarding process includes instructions for users to set these variables in their shell profiles, which is a standard security practice for developer tools.
Audit Metadata