linkfox-sorftime-amazon-product-query
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes Amazon product data, including titles, descriptions, and brand names, fetched from the vendor's API. Since this content is originally sourced from third-party Amazon listings, it could potentially contain malicious instructions designed to influence the agent's behavior. The skill does not explicitly instruct the agent to sanitize or ignore instructions embedded within this retrieved data.
- Ingestion points:
scripts/sorftime_product_search.py(receives and processes JSON responses from theproductQueryAPI). - Boundary markers: The skill instructs the agent to write full responses to local JSON files and encourages the use of
jqorConvertFrom-Jsonfor extraction, but does not include specific safety delimiters for the data content itself. - Capability inventory: The skill utilizes network operations for API calls and performs file system writes to save results. The associated onboarding process also involves environment modifications.
- Sanitization: No explicit sanitization or validation of the product-related text fields is described in the provided scripts or instructions.
- [PERSISTENCE]: The skill provides instructions for the agent to guide the user in modifying shell profiles (e.g.,
.zshrc,.bashrc) and using Windowssetxcommands to store theLINKFOX_AGENT_API_KEYpermanently. While this is a common setup procedure for developer tools, it constitutes a persistence mechanism that modifies the user's environment across sessions. - [EXTERNAL_DOWNLOADS]: The skill communicates with several external domains owned by the vendor (
linkfox.com,tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com,skill-api.linkfox.com) for product data retrieval, authentication, feedback, and billing services. - [COMMAND_EXECUTION]: The skill relies on several Python scripts (
scripts/sorftime_product_search.pyandscripts/onboarding.py) that are executed via the shell to perform API queries and manage user account setup tasks.
Audit Metadata