linkfox-shopify-store-query
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The SKILL.md file contains instructions in the 'Resolving authentication and points issues' section that attempt to nudge the agent toward persistent behavior. It specifies that the agent 'cannot give up on downloading' an external component if user authorization is required, which encourages the agent to continue its request even if the user is hesitant.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install a ZIP file from 'https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip' when specific error conditions like missing API keys are encountered. While the resource is hosted on the vendor's domain, the automated retrieval and installation of external skill components at runtime is an action that should only be performed with full user awareness.
Audit Metadata