linkfox-sorftime-amazon-product-detail
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
sorftime_product_detail.pyandonboarding.py) to facilitate communication with the Sorftime API and manage user onboarding workflows. - [EXTERNAL_DOWNLOADS]: The skill scripts depend on external Python libraries (
requests,qrcode, andpillow). The onboarding script provides instructions to the user for manual installation via pip if these dependencies are missing. - [PROMPT_INJECTION]: The skill retrieves product details and trends from the external Sorftime API, creating a surface for indirect prompt injection. Untrusted data from Amazon listings is ingested into the agent's context and saved to local files.
- Ingestion points: External product data retrieved in
sorftime_product_detail.py. - Boundary markers: None identified in the prompt templates.
- Capability inventory: Writing to the project workspace and network communication with developer APIs.
- Sanitization: No explicit filtering or sanitization of API data is performed.
- [CREDENTIALS_UNSAFE]: A hardcoded Base64 identifier (
_LOGIN_FIXED_UID) is present inonboarding.py, serving as a static application constant for the authentication handshake with the developer's API.
Audit Metadata