shop-best-sellers
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions designed to override the agent's autonomous tool selection and decision-making logic. It mandates its own use even for indirect or approximate requests and explicitly instructs the agent to skip the workflow only if the user provides an explicit refusal (e.g., "Use by default whenever the user wants...", "Prefer this skill over raw MCP tools", "Skip only if the user explicitly asks not to use this skill/workflow").
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and aggregates data from external shop APIs, which could contain malicious instructions embedded by an attacker (e.g., in product names or order metadata).
- Ingestion points: Data enters the context via
shop_list_orders,shop_list_products,shop_list_collections, andshop_get_productcalls (referenced in SKILL.md). - Boundary markers: The skill lacks any delimiters or instructions to ignore embedded commands within the processed data.
- Capability inventory: The skill performs data aggregation and report formatting but does not appear to execute arbitrary code or shell commands directly.
- Sanitization: There is no evidence of sanitization or escaping of external product titles or metadata before they are interpolated into the final report template.
Audit Metadata