Dld Product Billboard

This skill appears to be a thin client that forwards search parameters to LinkFox's product-billboard API and returns results — which is consistent with its purpose — but there are two issues you should consider before installing or providing credentials: - The package metadata did NOT declare the required environment variable, yet the code reads LINKFOXAGENT_API_KEY and will send it as an Authorization header to https://tool-gateway.linkfox.com. Do not set that API key unless you trust the LinkFox service and understand what that key grants access to. - The skill will transmit user-provided query parameters and any data included in requests to an external third-party endpoint. If the queries could include sensitive information (identifiers, proprietary product lists, supplier contacts), beware of exfiltration risk. Recommended steps: 1) Ask the publisher to update the registry metadata to declare LINKFOXAGENT_API_KEY (and explain the key's scope) so the requirement is visible before install. 2) Verify the LinkFox endpoints and the Feishu wiki link in the script to ensure they are legitimate for your organization. 3) If you must test, run the Python script locally first with a throwaway key and inspect network traffic. 4) Avoid providing other unrelated secrets to this skill. If you cannot verify the provider or metadata, treat the skill as untrusted.