skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-batch-product-detail/Gen Agent Trust Hub
ecommerce-tiktok-batch-product-detail
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/echotik_batch_product_detail.py) to communicate with the TikTok product API. The script is invoked with JSON parameters to perform batch lookups and handle data processing. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from TikTok Shop, including product descriptions (
descDetail), which are returned in the API response. This external content represents a potential ingestion point for indirect prompt injection attacks. - Ingestion points: Data is ingested through the vendor API response handled in
scripts/echotik_batch_product_detail.py. - Boundary markers: The script does not utilize explicit delimiters or markers to separate untrusted external data from system instructions.
- Capability inventory: The skill possesses capabilities for network communication and file writing to the local project filesystem.
- Sanitization: The script does not apply sanitization or filtering to the product descriptions before they are made available to the agent context.
Audit Metadata