skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-top-selling-products/Gen Agent Trust Hub
ecommerce-tiktok-top-selling-products
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests product data from an external TikTok/FastMoss API which could theoretically contain malicious instructions.
- Ingestion points: API responses from the
fastmoss/productRankTopSellingendpoint are processed inscripts/tiktok_top_selling_products.pyand returned to the agent context. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt templates.
- Capability inventory: The skill has the ability to write JSON data to the local file system (scripts/tiktok_top_selling_products.py) and execute shell commands via script arguments.
- Sanitization: Data is returned as a JSON object; no specific sanitization for natural language instructions within the data is performed.
- [COMMAND_EXECUTION]: The skill utilizes a Python script to perform API requests and file management.
- Execution pattern: The agent executes
scripts/tiktok_top_selling_products.pywith JSON arguments to perform data retrieval and local caching. - [DATA_EXFILTRATION]: The skill performs network requests to an external API to fetch ranking data.
- Network activity: The script transmits query parameters to the URL defined by
NEXSCOPE_PROXY_BASE. This is the intended functional behavior of the tool and uses vendor-provided infrastructure.
Audit Metadata