linkfox-shopee-store-discount
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/_shopee_discount_common.pyto execute a local dependency check script (check_auth_dependency.py). The command is restricted to the internal project path and uses the current Python interpreter. - [EXTERNAL_DOWNLOADS]: The skill communicates with vendor-controlled endpoints at
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.com. These connections are used to proxy Shopee API calls and manage user authentication/billing. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Shopee Open API. While it has the capability to write this data to the local filesystem (under the
linkfox/directory), there is no evidence of unsafe interpolation or automated execution of untrusted content. - Ingestion points: Shopee API responses via
developer_proxy_callinscripts/_discount_api_runner.py. - Boundary markers: None explicitly defined in the prompts.
- Capability inventory: Local file writing (
emit_result), network requests to vendor APIs, and internal script execution. - Sanitization: Standard JSON serialization is used for data handling.
Audit Metadata