linkfox-shopee-store-follow-prize
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runwithinscripts/_shopee_follow_prize_common.pyto executescripts/check_auth_dependency.py. This is used exclusively to verify the presence of the requiredlinkfox-shopee-store-authskill in the local environment and uses a statically defined path relative to the script location. - [EXTERNAL_DOWNLOADS]: The skill communicates with several vendor-owned domains (
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.com) to proxy Shopee API requests and manage account authentication/billing. These are legitimate resources belonging to the skill author (linkfox-ai). - [DATA_EXPOSURE]: The
emit_resultfunction inscripts/_shopee_follow_prize_common.pyautomatically writes full API responses, which may contain store activity data, to alinkfox/directory within the current project workspace. This is a documented design choice to allow the agent to process data without loading large JSON objects directly into the conversation context. - [CREDENTIALS_SAFE]: The skill requires the
LINKFOX_AGENT_API_KEYenvironment variable. Theonboarding.pyscript facilitates the acquisition of this key through a mobile verification process and provides instructions for the user to set the variable manually. It does not attempt to exfiltrate existing system credentials.
Audit Metadata