linkfox-zhihuiya-description-data-translated

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts, specifically scripts/zhihuiya_description_translated.py and scripts/onboarding.py, to perform patent data lookups and facilitate user authentication flows.
  • [EXTERNAL_DOWNLOADS]: The skill's scripts initiate network requests to vendor-controlled domains including tool-gateway.linkfox.com, api.linkfox.com, and agent-api.linkfox.com to retrieve translated data and manage user sessions.
  • [PERSISTENCE]: The onboarding documentation in references/onboarding.md provides guidance for users to persist their API keys by adding export commands to shell configuration files such as ~/.bashrc and ~/.zshrc, which is a standard procedure for this vendor's environment setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests technical technical patent descriptions from an external API, which acts as a surface for indirect prompt injection. \n
  • Ingestion points: Technical patent text is fetched via scripts/zhihuiya_description_translated.py. \n
  • Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the patent text. \n
  • Capability inventory: The skill has the capability to execute shell scripts and write technical data to the project directory. \n
  • Sanitization: No explicit sanitization or filtering of the patent technical descriptions is performed before the data is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 06:51 AM