ecommerce-ruiguan-gun-parts-search
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python scripts (
ruiguan_image_compliance_search.pyandupload_image.py) designed to be executed by the agent to perform similarity searches and handle image uploads via the vendor's API. - [EXTERNAL_DOWNLOADS]: The skill interacts with external vendor endpoints for its core functionality, including the policy detection API at
NEXSCOPE_PROXY_BASEand a feedback endpoint atskill-api.nexscope.com. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image URLs and retrieves data (product titles and images) from a remote database.
- Ingestion points: The
imageUrlparameter inSKILL.mdand processed viascripts/ruiguan_image_compliance_search.py. - Boundary markers: None explicitly defined in instructions or scripts.
- Capability inventory: Python scripts perform network requests and local file writes to the user's filesystem.
- Sanitization: Basic JSON structure validation is performed in the scripts.
- [SAFE]: The Python scripts access the
NEXSCOPE_API_KEYandNEXSCOPE_PROXY_BASEenvironment variables to authenticate legitimate API requests. - [SAFE]: The skill writes session logs and cached results to a
nexscopedirectory within the user's home or current working directory to improve performance and provide persistence for detection results.
Audit Metadata