LinkFoxAI

• Analyzed: May 7, 2026, 12:46 PM
• Findings: 1
• Version: 1.5.0
• Hash: aea3198b5d8d708ce7a705c69fa2f1fcec32d2a7a5628344a79333849e51e619
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides comprehensive AI media generation tools but is classified as suspicious due to high-risk functionality and a lack of input sanitization in `linkfoxai.py`. The `upload-base64` command permits reading arbitrary local files without path validation, which could be exploited for data exfiltration of sensitive files like SSH keys. Additionally, the `api-call` command serves as a generic proxy to any platform endpoint, and the `SKILL.md` instructions grant the agent significant autonomy in task execution and timeout handling, which increases the potential impact of prompt injection attacks.