linkfox-shopee-store-payment
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/_shopee_payment_common.pyusessubprocess.runto execute a local dependency checker (check_auth_dependency.py). The command is constructed using a direct path to the local file system andsys.executable, which is a safe practice for internal module verification. - [EXTERNAL_DOWNLOADS]: The skill communicates with various subdomains of
linkfox.com(e.g.,tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com) for Shopee API proxying, user authentication, and credit management. These resources are owned by the skill's vendor and represent intended functionality. - [CREDENTIALS_UNSAFE]: Authentication is handled through environment variables (
LINKFOX_AGENT_API_KEY), which is consistent with secure deployment practices for AI agent tools. - [DATA_EXFILTRATION]: The skill writes API response data to a session-specific folder within the project directory (
linkfox/). This behavior is clearly documented in the skill's instructions as a means for users to inspect full responses without overwhelming the LLM context. - [PROMPT_INJECTION]: The skill instructions provide clear guidance on error handling and authentication flows without attempting to bypass safety filters or override system-level instructions.
Audit Metadata