ecommerce-design-similarity-search
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bundled Python script (
scripts/design_similarity.py) to facilitate search operations. The script implements robust input validation, checking all parameters (such as image data, regions, and Locarno classifications) against a strict schema with defined length limits and regular expression patterns. - [INDIRECT_PROMPT_INJECTION]: As the skill ingests and processes data from an external API, it acknowledges the potential for indirect prompt injection. The instructions explicitly direct the agent to treat source text as untrusted data and avoid interpreting it as instructions. The script also limits the preview of candidate data to mitigate risks associated with large external payloads.
- [SAFE]: The skill interacts with the vendor's official API endpoint (
api.nexscope.ai) using secure HTTPS connections. It employs standard security measures such as disabling HTTP redirects, enforcing timeouts, and ensuring the API key is handled through the system environment rather than command-line arguments. The local caching mechanism uses one-way hashing to securely identify requests without exposing sensitive data in filenames.
Audit Metadata