skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-livestream-analytics/Gen Agent Trust Hub
ecommerce-tiktok-livestream-analytics
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the TikTok/Kalodata API, creating a potential indirect prompt injection surface. This is inherent to the skill's purpose of fetching live data.
- Ingestion points: Data enters the context through API responses processed in
scripts/livestream_detail.pyandscripts/livestream_rank.py. - Boundary markers: Absent in the script output, although instructions guide the agent on data-only presentation.
- Capability inventory: The skill includes scripts that execute network POST requests and write data to the project's
nexscope/directory. - Sanitization: The scripts process data as JSON; no specific sanitization of strings within the payloads is performed before presentation to the agent.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute local Python scripts included in the package. These scripts manage network communication with the vendor's API and handle local data caching, which is consistent with the skill's documented behavior.
- [DATA_EXPOSURE]: The skill handles authentication via environment variables and directs network requests to infrastructure belonging to the author (nexscope-ai). No unauthorized access to sensitive local files or data exfiltration attempts were identified.
Audit Metadata