skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-shop-product-detail/Gen Agent Trust Hub
ecommerce-tiktok-shop-product-detail
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/tiktok_shop_product_detail.pyto perform the API request and handle data processing. The script interacts with the environment to manage session IDs and log files. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: External marketplace data is ingested from the NexScope proxy API within the
call_apifunction inscripts/tiktok_shop_product_detail.py. - Boundary markers: The
SKILL.mdinstructions include a directive to "Summarize only returned facts" and "Preserve missing values as unknown," which helps prevent the agent from misinterpreting embedded instructions as commands. - Capability inventory: The skill has the capability to perform network requests to
api.nexscope.aiand write files to the local workspace under thenexscope/directory. - Sanitization: The script does not perform explicit sanitization of the marketplace text, relying on the agent's summarization instructions for safety.
- [DATA_EXPOSURE]: The skill writes the full JSON response from the API to the local filesystem at paths like
nexscope/<date>/<session>/data/. This behavior is documented and intended for research transparency, though it preserves external data in the agent's local environment.
Audit Metadata