linkfox-temu-fulfillment-eu
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages Temu access tokens by storing them in a local JSON file (
~/.linkfox/temu-access-tokens.json). These tokens, along with a LinkFox API key provided via environment variables, are transmitted to the vendor's gateway attool-gateway.linkfox.comto facilitate communication with Temu's APIs. This behavior is documented and central to the skill's functionality. - [EXTERNAL_DOWNLOADS]: The
onboarding.pyscript provides instructions for the user to install therequests,qrcode, andpillowPython libraries if they are not already present in the environment. These are standard libraries used for network requests and QR code generation for the onboarding process. - [COMMAND_EXECUTION]: The skill consists of various Python scripts designed to be executed by the agent to interact with the LinkFox gateway. These scripts perform structured API calls and handle local data storage for fulfillment operations. No instances of arbitrary or dangerous shell command execution were identified.
- [CREDENTIALS_UNSAFE]: The skill handles sensitive access tokens using environment variables (
LINKFOX_AGENT_API_KEY) and a local configuration file, avoiding hardcoded secrets within the source code. This is a standard and acceptable practice for API integrations.
Audit Metadata