linkfox-sorftime-walmart-product-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEPERSISTENCEEXTERNAL_DOWNLOADSOBFUSCATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The file
references/onboarding.mdprovides manual instructions for users to persist their API keys by appending export commands to shell configuration files such as~/.zshrcand~/.bashrc. - [EXTERNAL_DOWNLOADS]: The script
scripts/onboarding.pydynamically checks for the presence of therequests,qrcode, andpillowPython packages. If these dependencies are missing, the script provides the user with the appropriatepip installcommands to resolve the issue. - [OBFUSCATION]: The script
scripts/onboarding.pycontains a Base64-encoded string assigned to the_LOGIN_FIXED_UIDvariable. Decoded, it contains vendor-specific metadata:{"a_id":"6a22c8b05bc916a","d_id":""}. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided input (product names and IDs) which are sent to the LinkFox API gateway. The skill lacks explicit boundary markers or instructions to the agent to ignore potentially malicious content returned in the API response, creating an attack surface for indirect prompt injection.
Audit Metadata