skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-amazon-opportunity-report-by-keyword/Gen Agent Trust Hub
ecommerce-amazon-opportunity-report-by-keyword
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display external Markdown reports generated by an AI-powered API, creating a surface for potential instructions to be embedded in the report content.
- Ingestion points: The skill accepts a user-provided
keywordand retrieves astdoutfield containing Markdown text from the NexScope API (scripts/amazon_opportunity_report.py). - Boundary markers: The skill lacks explicit structural delimiters for the external content but includes a directive: "This tool's output cannot be fed into data query tools for further processing."
- Capability inventory: The skill's Python script performs network POST requests and writes JSON data to the local file system under the
nexscope/directory. - Sanitization: There is no evidence of sanitization or filtering of the Markdown content before it is displayed by the agent.
- [COMMAND_EXECUTION]: The skill relies on the execution of a Python script to handle its core logic, including API communication and data management.
- The
scripts/amazon_opportunity_report.pyscript is executed with user-controlled parameters passed as a JSON string. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to communicate with the vendor's API infrastructure.
- The Python script uses
urllib.request.urlopento send search parameters to the endpoint defined by theNEXSCOPE_PROXY_BASEenvironment variable. - These network operations are necessary for the skill's primary function of retrieving market opportunity reports.
Audit Metadata