ecommerce-amazon-sales-estimates
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external sales data retrieved from the Jungle Scout API. While this presents an attack surface for untrusted data, the risk is mitigated by the following:
- Ingestion points: External data enters the context through API responses in
scripts/amazon_sales_estimates.py. - Boundary markers: The instructions guide the agent to present data in specific structured formats (line charts and data tables) and check summaries first.
- Capability inventory: Capabilities are limited to writing JSON response files to a project-specific subdirectory (
nexscope/) and displaying data to the user. There is no evidence of subprocess execution, dynamic code evaluation, or unrestricted network access. - Sanitization: API responses are parsed using the standard library JSON parser.
- [EXTERNAL_DOWNLOADS]: The skill communicates with an external API endpoint via the
NEXSCOPE_PROXY_BASEenvironment variable to retrieve sales estimates. This is a standard functional requirement for the skill and uses standard authorization headers. - [SAFE]: No malicious patterns, obfuscation, persistence mechanisms, or unauthorized privilege escalation attempts were detected in the skill instructions or accompanying scripts.
Audit Metadata