skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-product-analytics-api/Gen Agent Trust Hub
ecommerce-tiktok-product-analytics-api
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes price, sales, and product data from external TikTok analytics providers, which could potentially contain malicious instructions intended to influence the agent.
- Ingestion points: API responses retrieved from the Nexscope gateway in
scripts/kalodata_product_detail.pyvia thecall_apifunction. - Boundary markers: Absent; the instructions do not implement explicit delimiters or guardrails directing the agent to ignore instructions embedded within the retrieved product data.
- Capability inventory: The skill possesses the ability to perform network requests (via
urllib.request) and write to the local file system (session data, caches, and artifacts in thenexscope/directory). - Sanitization: The script uses standard JSON decoding and encoding but does not include logic to sanitize or filter potential prompt injection payloads from the marketplace data.
- [COMMAND_EXECUTION]: The skill invokes a local Python script,
scripts/kalodata_product_detail.py, to handle data retrieval, caching, and session lifecycle management. This execution is aligned with the skill's primary stated purpose.
Audit Metadata