linkfox-zhihuiya-utility-patent-image-search
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [PERSISTENCE_MECHANISMS]: The onboarding documentation in onboarding.md instructs users to persist API keys by adding export commands to shell profiles like .bashrc or .zshrc. This is a standard and transparent procedure for configuring environment variables required for tool authentication.
- [DATA_EXPOSURE]: The skill manages user credentials via environment variables and transmits onboarding data, including phone numbers, to vendor-controlled endpoints at *.linkfox.com in onboarding.py. This represents standard operational behavior for the service's authentication flow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes patent metadata from the Zhihuiya API. Evidence Chain: 1. Ingestion points: zhihuiya_patent_image_search.py reads data from the patent search API response; 2. Boundary markers: Absent; 3. Capability inventory: Python script execution and local file writing in the linkfox/ directory; 4. Sanitization: Absent. The risk is classified as low due to the specialized nature of the retrieved content and the skill's specific retrieval context.
Audit Metadata