linkfox-zhihuiya-claim-data
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Python scripts (
scripts/onboarding.pyandscripts/zhihuiya_claim_data.py) to manage authentication, process payments, and retrieve patent information. - [EXTERNAL_DOWNLOADS]: Network requests are made to vendor-owned domains, including
tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com, andskill-api.linkfox.com, for data retrieval and user account management. - [INDIRECT_PROMPT_INJECTION]: The skill processes patent claims data from an external source, which represents a surface for indirect prompt injection.
- Ingestion points: Data is fetched from the Zhihuiya database via the vendor's API gateway in
scripts/zhihuiya_claim_data.py. - Boundary markers: None identified in the prompt templates.
- Capability inventory: The skill can execute local scripts and write data to the
linkfox/directory within the workspace. - Sanitization: No specific sanitization or filtering of the retrieved patent text is performed before display.
Audit Metadata