skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-mercado-market-intelligence/Gen Agent Trust Hub
ecommerce-mercado-market-intelligence
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts to perform marketplace research and asset management.
scripts/damai_mercado_market_intelligence.pyis used to query the Mercado Libre proxy API with user-supplied JSON parameters.scripts/upload_image.pyhandles image processing and upload workflows for visual searches.- [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with vendor-controlled infrastructure.
- Fetches market data from the Nexscope proxy (
api.nexscope.ai). - Uploads images to presigned URLs and confirms assets via the Skill Asset API.
- Submits diagnostic feedback to
skill-api.nexscope.com. - [PERSISTENCE]: The skill maintains a local file structure to track session history and cache results.
- Automatically creates a
nexscope/directory containing dated session folders, search result JSON artifacts, and a cache (.cache/). - Updates a persistent
index.jsonlfile and_meta.jsonper session to track deliverables and tool usage. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a public marketplace, creating a potential injection surface.
- Ingestion points: Raw JSON responses from the Mercado Libre research proxy (via the Nexscope gateway) are parsed and summarized by the agent (
scripts/damai_mercado_market_intelligence.py). - Boundary markers: The
SKILL.mdprovides explicit instructions to "Summarize only returned facts," "Preserve missing values as unknown," and reject undocumented fields. - Capability inventory: The skill has the ability to perform network POST/PUT requests and write to the local file system within the
nexscope/root. - Sanitization: The scripts use standard JSON parsing and include logic to redact sensitive metadata, such as internal account identifiers and signed URLs, from user-facing output.
Audit Metadata