linkfox-shopee-store-auth
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/authorize_url.pyutilizessubprocess.runto interact with system clipboard utilities includingclip.exe(Windows),pbcopy(macOS),xclip,xsel, andwl-copy(Linux). This is a functional feature designed to allow users to easily copy the generated Shopee authorization URL to their clipboard. - [EXTERNAL_DOWNLOADS]: The skill communicates with official LinkFox API endpoints (
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.com) for store authorization, account onboarding, and billing management. These are vendor-owned resources consistent with the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Shopee API, such as store names and IDs, which are then processed by the agent. While the skill has network and file-writing capabilities, the data is primarily used for display and internal routing, posing a minimal security risk.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The
onboarding.pyscript manages sensitive information such as phone numbers and verification codes during the account registration process. These operations are performed over encrypted connections to the vendor's authentication services as part of the intended onboarding workflow.
Audit Metadata