linkfox-shopee-store-merchant

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The utility script _shopee_merchant_common.py uses subprocess.run to execute a local Python script check_auth_dependency.py. This is used to verify that the prerequisite authentication skill is installed in the local environment.
  • [PERSISTENCE_MECHANISMS]: The onboarding.md documentation and onboarding.py script provide users with instructions to persist their API keys by manually appending export statements to their shell profile files (e.g., ~/.zshrc, ~/.bashrc). This is a standard manual configuration step for environment-based authentication.
  • [DATA_EXPOSURE]: The skill reads authentication credentials from environment variables such as LINKFOX_AGENT_API_KEY. This is consistent with recommended security practices for managing sensitive tokens in developer tools.
  • [EXTERNAL_DOWNLOADS]: The onboarding documentation suggests the installation of standard third-party Python libraries like requests, qrcode, and pillow to enable specific local features like QR code generation for payments.
  • [DATA_EXFILTRATION]: The skill communicates with several external endpoints including tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com. These are all verified vendor-controlled domains used for proxying API requests and handling account authentication.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 07:02 AM
Security Audit — agent-trust-hub — linkfox-shopee-store-merchant