The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Shopee API responses through the developerProxy and saves the full JSON results to the local filesystem under the linkfox/ directory. If the agent is subsequently directed to read these saved files, it may encounter and execute malicious instructions embedded within the third-party data.
Ingestion points: External API responses from tool-gateway.linkfox.com are saved to disk by the emit_result function in scripts/_shopee_bundle_deal_common.py.
Boundary markers: None identified; raw API data is written directly to files.
Capability inventory: The skill possesses subprocess.run capabilities in scripts/_shopee_bundle_deal_common.py and file-writing capabilities in the same script.
Sanitization: No sanitization or validation of the remote data is performed before it is saved or potentially presented to the agent.
[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/_shopee_bundle_deal_common.py to execute its internal dependency checker script, scripts/check_auth_dependency.py. This is used to verify that the linkfox-shopee-store-auth skill is available in the environment.
[DATA_EXPOSURE]: The scripts/check_auth_dependency.py script performs a search across several system and user directories (such as ~/.claude/skills, ~/.cursor/skills, and ~/.linkfox/skills) to locate other installed skills. While this is used for dependency management, it involves scanning the user's home directory structures.
[REMOTE_CODE_EXECUTION]: The onboarding script (scripts/onboarding.py) requires external Python packages (requests, qrcode, pillow) for authentication and QR code generation. It provides instructions to the user to install these dependencies via pip.
[EXTERNAL_DOWNLOADS]: The skill communicates with vendor-owned infrastructure at tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com for API proxying, user registration, and billing operations. These interactions involve transmitting environment-based API keys and user credentials (phone numbers/SMS codes) to the vendor's servers.

linkfox-shopee-store-bundle-deal