The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/_shopee_push_common.py utilizes subprocess.run to execute a local Python script check_auth_dependency.py. This is performed to verify that a required skill dependency is present in the environment.
[EXTERNAL_DOWNLOADS]: The skill communicates with vendor-owned domains (tool-gateway.linkfox.com, api.linkfox.com, agent-api.linkfox.com) to proxy Shopee API calls and manage user account functions like login and billing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Shopee API responses and prints the results to the standard output. Malicious content returned from a compromised or attacker-controlled store could potentially influence the agent's context.
Ingestion points: API response bodies retrieved via the developerProxy call in scripts/_push_api_runner.py and scripts/_shopee_push_common.py.
Boundary markers: None identified; response data is printed directly to the console.
Capability inventory: Network operations via urllib and requests, file system writes to the linkfox/ directory, and local script execution via subprocess.run.
Sanitization: None identified; content is parsed as JSON but raw strings from fields are interpolated into the agent's context.
[PERSISTENCE]: The onboarding documentation in references/onboarding.md provides instructions for users to save their API key into shell profile files (e.g., .zshrc, .bashrc) to ensure the key persists across terminal sessions.

linkfox-shopee-store-push