linkfox-tsearch-search

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The URL pointing to a direct ZIP download (https://agent-files.linkfox.com/skills/linkfox-onboarding/release.zip…) is suspicious because it instructs users to download and install a packaged skill (an archive that may contain executables) outside standard package managers and is presented as a fallback install — a common vector for distributing malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). SKILL.md describes a runtime web search that extracts and returns searchList[].content (free-form page text from arbitrary public web results), which is then intended to be summarized directly by the agent—i.e., outsider-authored web content is ingested into the LLM context via the tool’s extracted content field.