linkfox-sorftime-amazon-product-query

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes Amazon product data, including titles, descriptions, and brand names, fetched from the vendor's API. Since this content is originally sourced from third-party Amazon listings, it could potentially contain malicious instructions designed to influence the agent's behavior. The skill does not explicitly instruct the agent to sanitize or ignore instructions embedded within this retrieved data.
  • Ingestion points: scripts/sorftime_product_search.py (receives and processes JSON responses from the productQuery API).
  • Boundary markers: The skill instructs the agent to write full responses to local JSON files and encourages the use of jq or ConvertFrom-Json for extraction, but does not include specific safety delimiters for the data content itself.
  • Capability inventory: The skill utilizes network operations for API calls and performs file system writes to save results. The associated onboarding process also involves environment modifications.
  • Sanitization: No explicit sanitization or validation of the product-related text fields is described in the provided scripts or instructions.
  • [PERSISTENCE]: The skill provides instructions for the agent to guide the user in modifying shell profiles (e.g., .zshrc, .bashrc) and using Windows setx commands to store the LINKFOX_AGENT_API_KEY permanently. While this is a common setup procedure for developer tools, it constitutes a persistence mechanism that modifies the user's environment across sessions.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with several external domains owned by the vendor (linkfox.com, tool-gateway.linkfox.com, api.linkfox.com, agent-api.linkfox.com, skill-api.linkfox.com) for product data retrieval, authentication, feedback, and billing services.
  • [COMMAND_EXECUTION]: The skill relies on several Python scripts (scripts/sorftime_product_search.py and scripts/onboarding.py) that are executed via the shell to perform API queries and manage user account setup tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 03:20 AM