The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from the external Shopee Open API, creating a vulnerability surface where third-party store data could potentially influence agent behavior.
Ingestion points: Data is fetched from the Shopee developer proxy in scripts/_add_on_deal_api_runner.py and processed in scripts/_shopee_add_on_deal_common.py via the merge_shopee_body function.
Boundary markers: The skill does not implement specific delimiters or "ignore" instructions to isolate ingested Shopee data from the agent's system prompt.
Capability inventory: The skill has the ability to write JSON responses to the local filesystem and perform further network requests based on task requirements.
Sanitization: While data is parsed as JSON, the text content within Shopee API responses is not sanitized for prompt injection patterns before being summarized for the agent.
[COMMAND_EXECUTION]: The skill programmatically executes a local Python script to ensure necessary dependencies are installed.
Evidence: scripts/_shopee_add_on_deal_common.py uses subprocess.run to call scripts/check_auth_dependency.py. This is used exclusively for internal state validation.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to the author's infrastructure to handle authentication, billing, and API proxying.
Evidence: API calls are made to tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com as seen in scripts/_shopee_add_on_deal_common.py and scripts/onboarding.py.

linkfox-shopee-store-add-on-deal