linkfox-shopee-store-merchant
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Shopee Merchant API responses via a developer proxy. Malicious content within these responses could potentially influence the agent's behavior. \n
- Ingestion points: API response data is handled by
scripts/_merchant_api_runner.pyand outputted throughscripts/_shopee_merchant_common.py.\n - Boundary markers: No specific delimiters or safety instructions are used to separate API data from instructions.\n
- Capability inventory: The skill possesses the ability to write JSON data files locally and perform network requests to vendor-controlled domains.\n
- Sanitization: API responses are converted to JSON and printed without explicit filtering of string content.\n- [DYNAMIC_EXECUTION]: The skill performs a local script execution to verify its dependencies. \n
- Evidence: The function
ensure_auth_skill_availableinscripts/_shopee_merchant_common.pycallsscripts/check_auth_dependency.pyusingsubprocess.run. The execution path is derived from the module location and uses the active Python interpreter.
Audit Metadata