linkfox-shopee-store-shop-flash-sale
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/_shopee_shop_flash_sale_common.pyexecutes a local authentication checker (scripts/check_auth_dependency.py) viasubprocess.run. This is a standard procedure to verify the presence of required sub-components before execution. - [DATA_EXFILTRATION]: The skill transmits commerce identifiers to
tool-gateway.linkfox.comandapi.linkfox.com. These communications are directed to verified vendor infrastructure necessary for Shopee API proxying and user onboarding. - [EXTERNAL_DOWNLOADS]: The onboarding documentation suggests the installation of well-known Python packages (
qrcode,pillow,requests) from the official PyPI registry to support optional features like QR code generation for payments. - [INDIRECT_PROMPT_INJECTION]: The skill processes structured data retrieved from external Shopee API responses. While this represents a potential attack surface for malicious strings in product metadata, the risk is consistent with standard API integrations and is managed by the underlying agent platform.
- [PERSISTENCE]: Manual instructions are provided in
references/onboarding.mdfor users to persist credentials by updating their shell profile configuration. This is an standard, user-initiated setup process for command-line tools.
Audit Metadata