linkfox-shopee-store-merchant
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The utility script
_shopee_merchant_common.pyusessubprocess.runto execute a local Python scriptcheck_auth_dependency.py. This is used to verify that the prerequisite authentication skill is installed in the local environment. - [PERSISTENCE_MECHANISMS]: The
onboarding.mddocumentation andonboarding.pyscript provide users with instructions to persist their API keys by manually appending export statements to their shell profile files (e.g.,~/.zshrc,~/.bashrc). This is a standard manual configuration step for environment-based authentication. - [DATA_EXPOSURE]: The skill reads authentication credentials from environment variables such as
LINKFOX_AGENT_API_KEY. This is consistent with recommended security practices for managing sensitive tokens in developer tools. - [EXTERNAL_DOWNLOADS]: The onboarding documentation suggests the installation of standard third-party Python libraries like
requests,qrcode, andpillowto enable specific local features like QR code generation for payments. - [DATA_EXFILTRATION]: The skill communicates with several external endpoints including
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.com. These are all verified vendor-controlled domains used for proxying API requests and handling account authentication.
Audit Metadata