ecommerce-amazon-market-research
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote API (SellerSprite via NexScope proxy), which is a standard entry point for indirect prompt injection if the remote source were compromised.
- Ingestion points: External API responses are fetched and processed in
scripts/amazon_market_research.py. - Boundary markers: No explicit delimiters or instructions are used to separate the external data from the agent's instructions in the script logic.
- Capability inventory: The script performs network POST requests and writes JSON data files to the local
nexscope/directory within the workspace. - Sanitization: The tool acts as a data proxy and does not sanitize the JSON content before saving it to disk or displaying summaries to the user.
- [DATA_EXPOSURE]: The skill manages authentication using the
NEXSCOPE_API_KEYenvironment variable. It correctly directs requests to the vendor's proxy endpoint (NEXSCOPE_PROXY_BASE), following standard security practices for API-based tools.
Audit Metadata