linkfox-shopee-store-voucher
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs a local prerequisite check in _shopee_voucher_common.py using subprocess.run to execute a sibling script, check_auth_dependency.py. This internal execution is used solely for environment validation and does not process external or untrusted inputs.
- [EXTERNAL_DOWNLOADS]: The onboarding.py script and common API modules communicate with official LinkFox domains (e.g., tool-gateway.linkfox.com, api.linkfox.com) to facilitate user login, account registration, and plan management. These operations are standard for the vendor's service model.
- [DATA_EXFILTRATION]: The skill handles sensitive information such as API keys and store identifiers by retrieving them from environment variables or user input and transmitting them to the LinkFox gateway. This data flow is restricted to authorized vendor endpoints necessary for Shopee API proxying.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from Shopee API responses (e.g., voucher lists). It mitigates injection risks by utilizing structured JSON parsing and providing instructions for specific field extraction, thereby limiting the potential for malicious data to influence the agent's behavior.
Audit Metadata