skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-shop-product-detail/Gen Agent Trust Hub
ecommerce-tiktok-shop-product-detail
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external product data from TikTok Shop which could potentially contain malicious instructions intended to manipulate the agent's behavior.
- Ingestion points: Product metadata (title, category, seller information, and descriptions) is retrieved via the
api.nexscope.aiproxy and processed by the agent. - Boundary markers: The
SKILL.mdfile contains explicit instructions to "Summarize only returned facts," "Preserve missing values as unknown," and "Preserve source currencies... do not invent conversions," which act as natural boundaries to restrict the agent's interpretation of external data. - Capability inventory: The skill executes a Python script (
scripts/tiktok_shop_product_detail.py) that performs network POST requests and writes session-specific logs and cache files to the local project directory. - Sanitization: Input parameters are strictly validated as JSON in the Python script; however, the agent directly summarizes the textual content of the product details without a dedicated sanitization layer for embedded instructions.
Audit Metadata