The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection because it ingests large amounts of untrusted external data and feeds it directly into LLM prompts for evaluation.
Ingestion points: Data enters the system via product identifiers in SKILL.md, web search results (DuckDuckGo) in scripts/api_client_base.py, and responses from external AI engines (ChatGPT, Claude, Gemini, DeepSeek) collected in scripts/api_capture_runner.py.
Boundary markers: Prompts in assets/prompts/evaluator.md and scripts/evaluator.py interpolate untrusted content (like product USPs and LLM responses) using standard Markdown headers, but do not employ robust isolation techniques such as unique delimiters or "ignore embedded instructions" warnings.
Capability inventory: The skill possesses capabilities to write files (profile_builder.py), perform network operations (api_client_base.py, send_report_email.py), and execute shell commands (SKILL.md).
Sanitization: Sanitization is minimal; api_client_base.py performs basic regex-based HTML tag removal on search snippets, but there is no semantic filtering of potentially malicious instructions embedded in product descriptions or external engine responses.
[COMMAND_EXECUTION]: The SKILL.md file provides shell command templates that are potentially vulnerable to command injection if the AI agent does not perform proper sanitization of variables.
Evidence: In Phase 2, Step 5, the instruction is to run: python3 scripts/send_report_email.py "<product_name>" "<workdir>/data/runs/<slug>/<run_id>" "<report_url>". While variables are wrapped in double quotes, if the <product_name> (which can be derived from user input or search results) contains shell metacharacters like backticks or subshell expansions, it could lead to unauthorized command execution.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services to perform its core functions. These interactions are consistent with the skill's purpose and target vendor-controlled or well-known infrastructure.
DuckDuckGo: scripts/api_client_base.py performs POST requests to https://html.duckduckgo.com/html/ to gather product information.
Nexscope API: The skill communicates with the vendor's gateway (https://agent-aigw-test.nexscope.ai/v1) for LLM querying and uses scripts/send_report_email.py to send metrics to the Nexscope proxy endpoint for notification services.

ecommerce-product-ai-visibility