The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python scripts (scripts/product_detail.py, scripts/product_rank.py) to perform network requests and process JSON data. These scripts are executed with specific JSON parameters provided by the agent. The execution is scoped to the skill's intended purpose of data retrieval from the NexScope proxy.
[DATA_EXPOSURE]: The skill manages authentication using the NEXSCOPE_API_KEY environment variable. It correctly avoids hardcoding secrets and provides clear instructions for the user to manage their credentials securely. File writing is restricted to a structured directory under nexscope/ within the current working directory, which is a standard practice for persistent data in this environment.
[EXTERNAL_DOWNLOADS]: The scripts perform network operations to a proxy URL defined in the NEXSCOPE_PROXY_BASE environment variable. These requests target official vendor endpoints (/api/v1/tools/research/kalodata/...) and are used solely to fetch TikTok product data as described in the manifest. The use of a proxy base via environment variables is a common and safe pattern for enterprise-level agent integrations.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Kalodata API. While this presents a surface for indirect injection (e.g., malicious product titles), the threat is mitigated by the structured nature of the data (JSON) and the specific analytical focus of the skill. The instructions include clear display rules for formatting the API response, reducing the likelihood of the agent misinterpreting data as instructions.
[SAFE]: Overall, the skill implements robust error handling, local caching to minimize API costs, and follows the principle of least privilege regarding file system access. The functionality aligns exactly with the stated metadata and documentation.

ecommerce-tiktok-product-analytics