linkfox-sorftime-walmart-keyword-research
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute local Python scripts (
scripts/sorftime_walmart_keyword_research.pyandscripts/onboarding.py) to interact with the API and manage user accounts. - [EXTERNAL_DOWNLOADS]: The Python scripts perform network operations to
api.linkfox.com,agent-api.linkfox.com, andtool-gateway.linkfox.comfor authentication, payment processing, and keyword research data. These domains are associated with the skill vendor 'linkfox-ai'. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Sorftime keyword research APIs which is then presented to the agent.
- Ingestion points: Data enters the agent's context through the output of
scripts/sorftime_walmart_keyword_research.py(which fetches data from the API). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the retrieved research data.
- Capability inventory: The skill has the ability to execute shell commands (running scripts) and write files to the local project directory.
- Sanitization: There is no explicit sanitization or filtering of the retrieved API data before it is presented to the agent.
- [DATA_EXPOSURE]: The skill manages authentication via the
LINKFOX_AGENT_API_KEYenvironment variable. Thescripts/onboarding.pyscript provides instructions for users to set this variable in their shell profiles (.bashrc,.zshrc, etc.) to persist the key.
Audit Metadata