skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-amazon-broad-product-search/Gen Agent Trust Hub
ecommerce-amazon-broad-product-search
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external product data (titles, descriptions, categories) from Amazon via the SellerSprite API. This data is untrusted and could theoretically contain malicious instructions designed to influence the agent's behavior.\n
- Ingestion points: The script
scripts/amazon_broad_product_search.pyfetches JSON data containing product details from the vendor's API endpoint.\n - Boundary markers: The skill instructions do not specify delimiters or instructions to ignore potential commands within the product data.\n
- Capability inventory: The skill has the capability to write JSON files to the local
nexscope/directory and print data to stdout.\n - Sanitization: There is no evidence of data sanitization or filtering of the API response before it is presented to the agent.\n- [EXTERNAL_DOWNLOADS]: The Python script performs network operations to fetch product data from the vendor's API endpoint (nexscope.ai). This is the intended core functionality of the skill.\n- [COMMAND_EXECUTION]: The skill instructions provide parameters and examples for executing a local Python script (
scripts/amazon_broad_product_search.py) to perform its queries. This is the standard behavior for this tool's implementation.
Audit Metadata