linkfox-zhihuiya-pdf-data
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python scripts (
zhihuiya_pdf_data.pyandonboarding.py) to interact with the Zhihuiya database and handle user authentication. These scripts perform routine file system operations, such as creating session-specific data logs in thelinkfox/directory and maintaining a local 24-hour cache. - [EXTERNAL_DOWNLOADS]: The skill connects to vendor-owned domains, including
tool-gateway.linkfox.com,api.linkfox.com, andagent-api.linkfox.com. These connections are used to fetch patent document links, process user logins via SMS, and manage subscription plans. All external communication is consistent with the vendor's provided services. - [CREDENTIALS_UNSAFE]: The skill manages authentication through environment variables (
LINKFOX_AGENT_API_KEY). It provides clear guidance for users to persist these credentials in their shell configuration files (.bashrc,.zshrc) to ensure the agent maintains access across sessions, which is standard configuration practice for CLI-based tools. - [DATA_EXFILTRATION]: During the onboarding process, the skill transmits user-provided phone numbers to the vendor's authentication endpoint (
api.linkfox.com) to facilitate SMS-based login. This data transfer is a functional requirement for creating and authenticating the user's service account.
Audit Metadata