skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-ruiguan-copyright-detection/Gen Agent Trust Hub
ecommerce-ruiguan-copyright-detection
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The Python scripts (
ruiguan_copyright_detection.pyandupload_image.py) make network requests to Nexscope API endpoints (viaNEXSCOPE_PROXY_BASEand specific feedback URLs) to perform copyright analysis and asset uploads. These operations are required for the skill's primary functionality and target vendor-controlled domains. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and displays information returned from an external API (such as rights owner details and similarity scores). This creates a vulnerability surface where the agent could potentially be influenced by instructions embedded in the API response data.
- Ingestion points: The
call_apifunction inscripts/ruiguan_copyright_detection.pyreceives JSON data from a remote endpoint. - Boundary markers: The skill documentation provides display rules but does not implement specific delimiters or 'ignore' instructions for the ingested data.
- Capability inventory: The skill includes network access and the ability to write files to the local filesystem for caching and session management.
- Sanitization: The scripts do not perform specific sanitization or filtering of the API response content beyond standard JSON parsing.
Audit Metadata