The Agent Skills Directory

[SAFE]: The skill's code and instructions are consistent with its stated purpose of providing Amazon ASIN and keyword research. No malicious patterns such as persistence, privilege escalation, or obfuscation were found.
[EXTERNAL_DOWNLOADS]: The skill performs legitimate network requests to vendor-controlled domains including tool-gateway.linkfox.com and skill-api.linkfox.com. It also references a vendor-hosted skill package at agent-files.linkfox.com for onboarding purposes. These destinations are consistent with the vendor's infrastructure.
[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/xiyou.py) to process query parameters and communicate with the remote API. This is a standard execution pattern for this type of skill.
[CREDENTIALS_UNSAFE]: The skill requires multiple API keys (LINKFOXAGENT_API_KEY, XIYOU_CLIENT_ID, XIYOU_CLIENT_SECRET). The documentation correctly instructs the user to provide these via environment variables rather than hardcoding them, which follows security best practices.
[DATA_EXFILTRATION]: As part of its core functionality, the skill transmits Amazon ASINs and search keywords to the LinkFox gateway. This data transmission is intended and necessary for the analytical services provided.

linkfox-xiyou-dongcha