skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-ozon-product-report-search/Gen Agent Trust Hub
ecommerce-ozon-product-report-search
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (scripts/ozon_product_report_search.py) to perform API requests. The script utilizes standard libraries (urllib) and does not invoke external shell commands or arbitrary code.
- [EXTERNAL_DOWNLOADS]: The skill connects to the NexScope proxy API (NEXSCOPE_PROXY_BASE) to fetch marketplace data. This is a documented vendor resource and standard functionality for the skill's purpose.
- [CREDENTIALS_UNSAFE]: The skill manages authentication using the NEXSCOPE_API_KEY environment variable. This is a secure practice compared to hardcoding keys and aligns with standard secret management.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests product report data from the Ozon marketplace via an external API. This data is written to disk and presented to the agent, creating a potential surface for indirect prompt injection from marketplace content. However, the data is processed as structured JSON, and no evidence of exploitation was found.
- [SAFE]: The skill follows established patterns for vendor-provided tools, including local caching and session-based output organization within the project directory.
Audit Metadata