skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-zhihuiya-patent-image-search/Gen Agent Trust Hub
ecommerce-zhihuiya-patent-image-search
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from a patent database and displays it to the agent.
- Ingestion points: External patent information, including titles, abstracts, and descriptions, are retrieved via the
/zhihuiya/patentImageSearchAPI and processed byscripts/zhihuiya_patent_image_search.py. - Boundary markers: The skill lacks explicit instructions to ignore embedded commands within the retrieved patent data, although it does append a mandatory legal disclaimer to the final output.
- Capability inventory: The skill maintains capabilities for network requests (via
urllib) and local file writing for session logging and caching. - Sanitization: There is no evidence of sanitization or escaping of the retrieved patent text before it is interpolated into the agent's response.
- [COMMAND_EXECUTION]: The skill requires the execution of Python scripts (
scripts/zhihuiya_patent_image_search.pyandscripts/upload_image.py) to function. - The scripts perform network operations to interact with the Nexscope API at
NEXSCOPE_PROXY_BASEandskill-api.nexscope.com. scripts/zhihuiya_patent_image_search.pycreates a local directory namednexscopein the current working directory or user home folder to manage cache files and session logs.
Audit Metadata