The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local Python script (scripts/echotik_list_video_rank.py) to execute API requests and process research data. The script uses standard libraries and performs well-defined operations without arbitrary command execution or shell injection risks.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to api.nexscope.ai (the research proxy) and skill-api.nexscope.com (for feedback). These domains are official vendor resources belonging to nexscope-ai and are used for the skill's documented functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from TikTok (such as video descriptions, nicknames, and categories), which are external and untrusted sources. This represents a known attack surface for indirect prompt injection.
Ingestion points: External video ranking data is ingested from the EchoTik API response in scripts/echotik_list_video_rank.py.
Boundary markers: The instructions in SKILL.md include explicit constraints for the agent to "Summarize only returned facts" and "Preserve missing values as unknown," which serve as effective boundary markers to mitigate the risk of following instructions embedded in the data.
Capability inventory: The script is capable of writing JSON response data to the local filesystem (within the nexscope directory of the workspace or home folder) and sending sentiment feedback to the vendor's feedback API.
Sanitization: The skill focuses on structured JSON processing and specific business field extraction, which reduces the likelihood of interpreting free-text video descriptions as instructions.

ecommerce-tiktok-video-rank