The Agent Skills Directory

[COMMAND_EXECUTION]: The shared helper script scripts/_shopee_video_common.py executes a local Python script check_auth_dependency.py using subprocess.run. This is used to verify that a required dependency skill is installed. The path to the script is constructed safely using the current file's directory.
[EXTERNAL_DOWNLOADS]: The skill communicates with several external endpoints under the vendor's domain linkfox.com (e.g., tool-gateway.linkfox.com, api.linkfox.com) to proxy Shopee API requests and manage account onboarding. These are recognized as legitimate vendor resources.
[DATA_EXFILTRATION]: Store-related data and Shopee API parameters are sent to the linkfox.com gateway. This is the primary function of the skill (providing a proxy to the Shopee Open Platform) and represents a legitimate data flow to the service provider.
[INDIRECT_PROMPT_INJECTION]: The skill processes data returned from external Shopee APIs. While this creates a surface for indirect prompt injection if the API responses contain malicious instructions, the skill implements a local logging mechanism that encourages the use of tools like jq to extract specific fields, reducing the risk of the entire payload entering the agent's context. The instructions also advise the agent on how to handle specific error codes and feedback triggers.

linkfox-shopee-store-video