linkfox-shopee-store-ams
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/_shopee_ams_common.pyusessubprocess.runto execute an internal script (check_auth_dependency.py) to verify if the required authentication dependency skill is installed. This execution is safe and well-contained as it uses a hardcoded argument list withsys.executableand contains no user-controlled command injection paths. - [EXTERNAL_DOWNLOADS]: Scripts interact with official LinkFox API domains (
tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com,skill-api.linkfox.com) to communicate with the Shopee gateway and handle account onboarding/billing workflows. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Shopee API endpoints. The response JSON is saved locally and printed to stdout (either full or as a summary) for the agent to interpret. While no explicit boundaries are applied to the printed JSON, this is a standard data retrieval surface for e-commerce tools.
Audit Metadata