The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Python scripts (scripts/ruiguan_trademark_graphic_detection.py and scripts/upload_image.py) to perform trademark detection and image handling. These scripts are invoked via shell commands as specified in the usage section of SKILL.md.
[EXTERNAL_DOWNLOADS]: The scripts perform network operations to communicate with vendor endpoints. Specifically, they send data to and receive results from the Ruiguan trademark detection service hosted on the vendor's proxy base and the skill feedback API (skill-api.nexscope.com). These are recognized as official vendor resources.
[DATA_EXFILTRATION]: The scripts/upload_image.py script is designed to read local image files (or base64 data) and upload them to a remote server for processing. While this is the intended function of the skill, it creates a mechanism for transferring local file content to an external service.
[PERSISTENCE]: The skill implements a local caching mechanism in scripts/ruiguan_trademark_graphic_detection.py. It creates a nexscope directory in the user's home folder or current working directory to store API response caches and session data, which persists across different executions of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes trademark information retrieved from external databases, including trademark names and status descriptions, which are then displayed to the user. This exposes an attack surface where malicious content embedded in trademark data could influence the agent's behavior.
Ingestion points: External data enters the agent context through the API response handled by the call_api and main functions in scripts/ruiguan_trademark_graphic_detection.py.
Boundary markers: The instructions in SKILL.md provide structure for displaying results but do not include explicit prompt delimiters or warnings to treat the trademark data as untrusted.
Capability inventory: The skill has the capability to execute scripts, read local files, write to the filesystem, and perform network requests.
Sanitization: The scripts do not perform explicit sanitization or filtering of the text fields returned by the external trademark API before they are presented to the agent for formatting.

ecommerce-ruiguan-trademark-graphic-detection