amazon-competitor-intelligence-monitor
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python utility (
scripts/zoodata.py) to handle API communication and data processing. Technical review of the script confirms it uses subprocesses exclusively for self-maintenance (cleaning up its own temporary files) without incorporating untrusted user input into shell commands. - [EXTERNAL_DOWNLOADS]: Fetches market intelligence and product data from the official ZooData API (
api.zoodata.ai). The skill includes a dedicated security function (_is_trusted_host) that validates the target host before transmission, effectively preventing credential exfiltration to unauthorized domains. - [INDIRECT_PROMPT_INJECTION]: The skill processes external Amazon product reviews, which constitutes a surface for indirect prompt injection. This risk is appropriately managed by the skill's architecture, which uses the data for specific analytical extraction (sentiment and theme tagging) rather than allowing it to influence agent control flow.
- [CREDENTIALS_SAFE]: Credentials are managed securely via environment variables or a local configuration file (
~/.zoodata/config.json) with restricted access, which is the standard practice for local agent tools.
Audit Metadata