skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-amazon-market-product-detail/Gen Agent Trust Hub
ecommerce-amazon-market-product-detail
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted product data, including titles, descriptions, and bullet points from Amazon marketplace listings via the Sorftime API, creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent context through the
productslist returned by the API call inscripts/amazon_market_product_detail.py. - Boundary markers: The skill instructions do not specify any markers or "ignore instructions" warnings to wrap the external content during presentation.
- Capability inventory: The script has the capability to write files to the local project directory (under the
nexscope/folder) and perform network operations via thecall_apifunction. - Sanitization: The script parses the raw JSON response but does not appear to perform sanitization or filtering on the textual fields before they are passed to the agent.
Audit Metadata