The Agent Skills Directory

[SAFE]: The skill operates within the expected scope of a Shopee API integration. All remote communications are performed against the vendor's own API endpoints (linkfox.com) using standard authentication headers.
[COMMAND_EXECUTION]: The skill performs an internal dependency check by executing a local script check_auth_dependency.py via subprocess.run. The implementation uses a list-based argument structure, which is the secure way to invoke subprocesses as it avoids shell interpretation and potential injection.
[DATA_EXPOSURE]: Responses from Shopee APIs are logged to a specific project directory (linkfox/) for debugging and session state. The skill implements logic to select an appropriate writable directory, ensuring that data is stored predictably and not in sensitive system areas.
[INDIRECT_PROMPT_INJECTION]: As the skill ingests data from the external Shopee API, it presents a surface for indirect prompt injection. However, the risk is managed by returning structured JSON data and directing the agent to use tools like jq to parse specific fields, preventing the entire external payload from being interpreted as instructions by the language model.

linkfox-shopee-store-returns