ecommerce-growth-strategy
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill collects competitor names or URLs from the user to assist in strategy development.
- Ingestion points: The skill defines a data collection workflow in
SKILL.md(Step 2, Question 7) that accepts user-supplied URLs. - Boundary markers: The instructions do not include specific delimiters or warnings for the agent to disregard potentially malicious instructions embedded in the external content.
- Capability inventory: While the skill is focused on strategy generation, an agent equipped with browsing tools could ingest untrusted content from these external URLs.
- Sanitization: There is no defined process for validating or sanitizing the provided URLs or their content.
- [EXTERNAL_DOWNLOADS]: The skill documentation provides command examples (
npx skills add) to fetch and install related e-commerce skills from the developer's GitHub repository (github.com/nexscope-ai/eCommerce-Skills). These references are legitimate vendor-owned resources intended for extending the skill's capabilities.
Audit Metadata