linkfox-shopee-store-product
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute a local script (check_auth_dependency.py) to verify the presence of required authentication dependencies. This execution is performed using a list of arguments and the current Python executable, preventing shell injection vulnerabilities. - [DATA_EXPOSURE]: Full API responses from Shopee are written to the local project directory under
./linkfox/to avoid overloading the agent's context window. This behavior is clearly documented in theSKILL.mdfile and is used for data persistence within the current workspace. - [EXTERNAL_DOWNLOADS]: The skill interacts with the vendor's official domains (
linkfox.comandlinkfox-ai.comsubdomains) to proxy Shopee API requests and submit product feedback. These interactions are necessary for the skill's primary purpose and target the author's own infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Shopee API responses. While this presents a potential surface for indirect injection if the product data contains malicious instructions, the skill mitigates this by instructing the agent to save responses to disk and use structured extraction tools like
jqto read specific fields.
Audit Metadata