The Agent Skills Directory

[PERSISTENCE]: In references/onboarding.md, the skill provides instructions for users to persist their LINKFOX_AGENT_API_KEY by adding export commands to shell profile files (~/.zshrc, ~/.bashrc) or by using the Windows setx command. While this is a documented configuration step for the service, it involves modifying system-level environment startup files.
[INDIRECT_PROMPT_INJECTION]: The skill fetches external Shopify product information (titles, links, and descriptions) via a remote API in scripts/shopify_product_query.py. This data is then processed within the agent's context.
Ingestion points: Remote Shopify API responses containing third-party product metadata.
Boundary markers: Absent. The data is processed as raw JSON and displayed to the agent.
Capability inventory: File system writes (log and data files in the linkfox/ directory) and network operations to vendor domains.
Sanitization: Absent. No filtering or sanitization is performed on product descriptions to prevent embedded natural language instructions.
[DATA_EXFILTRATION]: The scripts/onboarding.py script facilitates account registration and SMS login by transmitting the user's phone number to api.linkfox.com. Although this is a functional requirement for the vendor's service, it constitutes the transmission of personally identifiable information (PII) to a remote server.

linkfox-shopify-product-query