skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-amazon-opportunity-search-by-metrics/Gen Agent Trust Hub
ecommerce-amazon-opportunity-search-by-metrics
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from an external API that is then interpreted by the agent, creating a potential surface for indirect instructions.
- Ingestion points: Data is retrieved from the
/amazon/opportunity/searchByMetricsendpoint usingurllib.requestinscripts/amazon_opportunity_screener.py. - Boundary markers: Absent. The script prints the JSON response or a summary directly to stdout without using delimiters or instructions to the agent to ignore embedded commands.
- Capability inventory: The agent has the ability to write to the local filesystem (as demonstrated by the script's output logic) and execute further shell commands.
- Sanitization: Absent. The script does not filter or escape the contents of the API response (such as keyword fragments or review topics) before it enters the agent's context.
- [EXTERNAL_DOWNLOADS]: The script
scripts/amazon_opportunity_screener.pyperforms POST requests to the vendor's API base (NEXSCOPE_PROXY_BASE) to fetch market research data. This is the primary intended function of the skill. - [COMMAND_EXECUTION]: The skill operates by having the agent execute a local Python script (
scripts/amazon_opportunity_screener.py) with JSON-formatted arguments to interface with the research database.
Audit Metadata