linkfox-shopee-store-video
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The script
_shopee_video_common.pyutilizessubprocess.runto call an internal dependency check scriptscripts/check_auth_dependency.py. This is a legitimate use of command execution to verify the presence of required peer skills within the agent's environment. - [EXTERNAL_DOWNLOADS]: The skill interacts with external vendor endpoints including
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.comto process Shopee API requests and manage user authentication. These network operations are consistent with the skill's primary function and target vendor-controlled infrastructure. - [DATA_EXFILTRATION]: An automated feedback mechanism is implemented to send user interaction data, such as sentiment and category, to the vendor's feedback API at
skill-api.linkfox.com. While this involves sending data to an external server, the behavior is explicitly documented as a telemetry feature for service improvement. - [DATA_EXPOSURE]: API keys are managed through standard environment variables like
LINKFOX_AGENT_API_KEY, avoiding hardcoded secrets. The skill writes API response data to the local filesystem in a structured session directory for state management, which is a disclosed operational behavior.
Audit Metadata