linkfox-damai-mercado-market-intelligence
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute several Python scripts (
scripts/damai_mercado_market_intelligence.py,scripts/onboarding.py,scripts/upload_image.py) to perform its functions, including API calls, image handling, and account setup. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from an external marketplace (Mercado Libre), which could potentially contain malicious instructions.
- Ingestion points: Product details and user reviews retrieved through the
search_product_snapshotsandreview_searchoperations inscripts/damai_mercado_market_intelligence.py. - Boundary markers: The skill does not use explicit boundary markers or delimiters when presenting the retrieved external content to the agent.
- Capability inventory: The associated scripts can perform network operations to vendor-specified domains and write business data to the local file system.
- Sanitization: There is no evidence of sanitization or filtering applied to the external marketplace data before it is incorporated into the agent's context.
Audit Metadata