skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-google-trends-by-keywords/Gen Agent Trust Hub
ecommerce-google-trends-by-keywords
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Python script (
scripts/google_trends_by_keywords.py) to query the Google Trends API via a vendor-provided proxy. The script implements local caching and structured data storage within a dedicated project subdirectory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests search interest data from an external API, presenting an attack surface for indirect instructions.
- Ingestion points: Data retrieved from the
/googleTrend/getTrendByKeysendpoint is processed and displayed to the agent. - Boundary markers: The skill instructions lack explicit delimiting markers or warnings for the agent to ignore embedded commands within the external API response.
- Capability inventory: The skill includes scripts capable of network communication and file system writes.
- Sanitization: Standard JSON parsing is employed, but there is no specific validation or filtering of the natural language content within the external data payload.
Audit Metadata