skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-creator-search-api/Gen Agent Trust Hub
ecommerce-tiktok-creator-search-api
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a package-local Python script (
scripts/kalodata_creator_search.py) to interface with the research tool gateway. This is the primary intended functionality of the skill and does not involve arbitrary command execution.- [DATA_EXFILTRATION]: The skill accesses theNEXSCOPE_API_KEYenvironment variable to authenticate with the vendor-controlled proxy gateway (NEXSCOPE_PROXY_BASE). Authentication is handled using standard Bearer token headers, and the skill includes explicit instructions to prevent secrets from being persisted in logs or user-facing outputs. Communication is restricted to the vendor's own infrastructure.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external TikTok rankings search results, which constitutes an attack surface for indirect prompt injection. - Ingestion points: External API data is ingested and processed by the
kalodata_creator_search.pyscript. - Boundary markers: The skill does not use explicit delimiters for the external data, but it enforces display rules that require the agent to separate retrieved facts from calculations and to redact sensitive fields.
- Capability inventory: The script performs network operations via
urlliband writes cache/session data to the local file system. - Sanitization: The skill utilizes structured JSON parsing and defines strict rules for summarizing and redacting the returned payloads to minimize risk.
Audit Metadata