linkfox-zhihuiya-description-data-translated
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts, specifically
scripts/zhihuiya_description_translated.pyandscripts/onboarding.py, to perform patent data lookups and facilitate user authentication flows. - [EXTERNAL_DOWNLOADS]: The skill's scripts initiate network requests to vendor-controlled domains including
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.comto retrieve translated data and manage user sessions. - [PERSISTENCE]: The onboarding documentation in
references/onboarding.mdprovides guidance for users to persist their API keys by adding export commands to shell configuration files such as~/.bashrcand~/.zshrc, which is a standard procedure for this vendor's environment setup. - [INDIRECT_PROMPT_INJECTION]: The skill ingests technical technical patent descriptions from an external API, which acts as a surface for indirect prompt injection. \n
- Ingestion points: Technical patent text is fetched via
scripts/zhihuiya_description_translated.py. \n - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the patent text. \n
- Capability inventory: The skill has the capability to execute shell scripts and write technical data to the project directory. \n
- Sanitization: No explicit sanitization or filtering of the patent technical descriptions is performed before the data is processed by the agent.
Audit Metadata