skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-amazon-keyword-share-of-voice/Gen Agent Trust Hub
ecommerce-amazon-keyword-share-of-voice
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Python script (
scripts/amazon_keyword_share_of_voice.py) to manage API requests and data caching. The script takes JSON arguments and outputs summary or full data based on the response size. - [EXTERNAL_DOWNLOADS]: The skill fetches e-commerce data from a vendor-controlled API endpoint. These network operations are consistent with the skill's purpose and are authenticated using a standard API key approach.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (brand names, product titles, and SOV metrics) from Amazon search results. While this constitutes an attack surface, it is necessary for the skill's core function.
- Ingestion points: In
scripts/amazon_keyword_share_of_voice.py, data is received from the NexScope API. - Boundary markers: Data is processed as structured JSON; no specific prompt boundary instructions (like 'ignore embedded instructions') are implemented.
- Capability inventory: The skill can write JSON results to the local filesystem (
nexscope/directory) and make outbound network requests to the configured proxy. - Sanitization: The script uses standard JSON parsing (
json.loads) but does not perform content filtering for potential prompt injection characters within the brand or product names.
Audit Metadata