linkfox-shopee-store-payment

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/_shopee_payment_common.py uses subprocess.run to execute a local dependency checker (check_auth_dependency.py). The command is constructed using a direct path to the local file system and sys.executable, which is a safe practice for internal module verification.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with various subdomains of linkfox.com (e.g., tool-gateway.linkfox.com, api.linkfox.com, agent-api.linkfox.com) for Shopee API proxying, user authentication, and credit management. These resources are owned by the skill's vendor and represent intended functionality.
  • [CREDENTIALS_UNSAFE]: Authentication is handled through environment variables (LINKFOX_AGENT_API_KEY), which is consistent with secure deployment practices for AI agent tools.
  • [DATA_EXFILTRATION]: The skill writes API response data to a session-specific folder within the project directory (linkfox/). This behavior is clearly documented in the skill's instructions as a means for users to inspect full responses without overwhelming the LLM context.
  • [PROMPT_INJECTION]: The skill instructions provide clear guidance on error handling and authentication flows without attempting to bypass safety filters or override system-level instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 07:02 AM
Security Audit — agent-trust-hub — linkfox-shopee-store-payment