ecommerce-amazon-keyword-expansion
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests keyword metrics and competitive data from the Jungle Scout API, which could potentially contain malicious instructions designed to influence the agent's behavior. \n
- Ingestion points: Untrusted data enters the context through the API response processed in
scripts/amazon_keyword_expansion.py.\n - Boundary markers: Absent. The skill instructions do not specify the use of delimiters or warnings to isolate API-sourced content.\n
- Capability inventory: The skill possesses network access for API calls and file-writing capabilities for saving data to the
nexscope/directory as described inscripts/amazon_keyword_expansion.py.\n - Sanitization: Absent. There is no evidence of validation, filtering, or escaping of the API response data before it is presented to the user or stored.\n- [COMMAND_EXECUTION]: The skill is implemented by executing the Python script
scripts/amazon_keyword_expansion.pyusing shell commands with JSON-formatted arguments.
Audit Metadata