linkfox-shopee-store-auth

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/authorize_url.py utilizes subprocess.run to interact with system clipboard utilities including clip.exe (Windows), pbcopy (macOS), xclip, xsel, and wl-copy (Linux). This is a functional feature designed to allow users to easily copy the generated Shopee authorization URL to their clipboard.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with official LinkFox API endpoints (tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com) for store authorization, account onboarding, and billing management. These are vendor-owned resources consistent with the skill's purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Shopee API, such as store names and IDs, which are then processed by the agent. While the skill has network and file-writing capabilities, the data is primarily used for display and internal routing, posing a minimal security risk.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The onboarding.py script manages sensitive information such as phone numbers and verification codes during the account registration process. These operations are performed over encrypted connections to the vendor's authentication services as part of the intended onboarding workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 07:02 AM
Security Audit — agent-trust-hub — linkfox-shopee-store-auth