ecommerce-mercado-market-intelligence

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local Python scripts to perform marketplace research and asset management.
  • scripts/damai_mercado_market_intelligence.py is used to query the Mercado Libre proxy API with user-supplied JSON parameters.
  • scripts/upload_image.py handles image processing and upload workflows for visual searches.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with vendor-controlled infrastructure.
  • Fetches market data from the Nexscope proxy (api.nexscope.ai).
  • Uploads images to presigned URLs and confirms assets via the Skill Asset API.
  • Submits diagnostic feedback to skill-api.nexscope.com.
  • [PERSISTENCE]: The skill maintains a local file structure to track session history and cache results.
  • Automatically creates a nexscope/ directory containing dated session folders, search result JSON artifacts, and a cache (.cache/).
  • Updates a persistent index.jsonl file and _meta.json per session to track deliverables and tool usage.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a public marketplace, creating a potential injection surface.
  • Ingestion points: Raw JSON responses from the Mercado Libre research proxy (via the Nexscope gateway) are parsed and summarized by the agent (scripts/damai_mercado_market_intelligence.py).
  • Boundary markers: The SKILL.md provides explicit instructions to "Summarize only returned facts," "Preserve missing values as unknown," and reject undocumented fields.
  • Capability inventory: The skill has the ability to perform network POST/PUT requests and write to the local file system within the nexscope/ root.
  • Sanitization: The scripts use standard JSON parsing and include logic to redact sensitive metadata, such as internal account identifiers and signed URLs, from user-facing output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:13 AM
Security Audit — agent-trust-hub — ecommerce-mercado-market-intelligence