ecommerce-amazon-ads-api-access
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The script
scripts/amazon_connection.pyperforms network requests usingurllib.request.urlopento an external URL constructed from theNEXSCOPE_PROXY_BASEenvironment variable.\n - The
NEXSCOPE_API_KEYenvironment variable is transmitted in theAuthorizationheader of all network requests.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from an external API gateway, presenting a potential attack surface for indirect prompt injection.\n - Ingestion points: Data retrieved from the Amazon Ads API (via the gateway) is output by
scripts/amazon_connection.pyfor agent consumption.\n - Boundary markers: The skill instructions do not specify the use of delimiters or ignore-instructions to separate external data from agent logic.\n
- Capability inventory: The skill enables the agent to perform network requests and state mutations (authorization flow).\n
- Sanitization: The script performs standard JSON parsing but lacks specific sanitization logic to ensure external content does not influence the agent context.
Audit Metadata