linkfox-shopee-store-ads
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
_shopee_ads_common.pyscript usessubprocess.runto execute a local dependency checker (check_auth_dependency.py). This is a legitimate internal health check to ensure the required authentication skill is present in the environment. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.com. These are official API endpoints belonging to the skill's author (linkfox-ai) and are used for authenticated proxying of Shopee API requests and user onboarding. - [CREDENTIALS_SAFE]: The skill requires a
LINKFOX_AGENT_API_KEYto function. It correctly instructs users to manage this via environment variables and does not hardcode any secrets. Theonboarding.pyscript provides a mechanism for users to log in and retrieve their own keys securely from the vendor's service. - [DATA_EXFILTRATION]: While the skill accesses Shopee store data, it does so exclusively through the vendor's proxy as intended by its design. No sensitive local files (like SSH keys or AWS credentials) are accessed or transmitted.
Audit Metadata