skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-batch-product-detail/Gen Agent Trust Hub
ecommerce-tiktok-batch-product-detail
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/echotik_batch_product_detail.py) to interface with an external API. This script is intended to be executed by the agent to process TikTok product IDs and URLs. The execution is scoped to the skill's primary function of data retrieval. - [EXTERNAL_DOWNLOADS]: The script fetches data from a remote endpoint (
${NEXSCOPE_PROXY_BASE}/api/v1/tools/research/echotik/batchProductDetail) using provided API keys. The destination is the vendor's own infrastructure, which is consistent with the skill's purpose for TikTok product analysis. - [DATA_EXFILTRATION]: While the skill reads data from an external API and writes it to the local disk, it does not access or transmit sensitive local system information (like SSH keys or environment variables other than its own required API keys). The file-writing behavior is transparently documented to store results in a
nexscope/directory within the current working directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external TikTok product URLs and API responses. Although this is a potential ingestion point for untrusted content (like product descriptions), the skill guidelines instruct the agent to summarize or note the availability of long descriptions (
descDetail) rather than directly rendering raw HTML or long strings, which reduces the risk of the agent following instructions embedded in the data.
Audit Metadata