linkfox-zhihuiya-utility-patent-image-search
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with official service provider domains (linkfox.com) for patent data, image hosting, and account management. These communications are part of the intended functionality and target the vendor's verified infrastructure.
- [COMMAND_EXECUTION]: The included Python scripts perform standard operations such as making HTTPS requests and writing search results to local JSON files within the user's project directory. No arbitrary or malicious command execution patterns were found.
- [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive information by prompting users to set their API keys in environment variables rather than hardcoding them. A static Base64 identifier found in the login script is used as a public application/device ID for authentication purposes and is not a secret credential.
- [DATA_EXFILTRATION]: Network activity is restricted to the service provider's API endpoints and a dedicated feedback channel. There is no evidence of sensitive local file access or unauthorized data transfer to third-party domains.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied parameters like image URLs and search filters. These inputs are used as structured data for API requests and do not influence the agent's internal logic or execution flow in an unsafe manner.
Audit Metadata