amazon-competitor-intelligence-monitor
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a dedicated Python script (zoodata.py) to interact with the ZooData API. All network operations are directed to the vendor's official domain (api.zoodata.ai), which is consistent with the skill's stated purpose.
- [SAFE]: Credential management is handled securely. The script looks for the ZOODATA_API_KEY in environment variables or local configuration files (~/.zoodata/config.json), which is a standard and recommended practice for agent skills.
- [SAFE]: The skill implements a Prompt-as-Data pattern to analyze product reviews. It includes an indirect prompt injection surface as it processes untrusted review text from Amazon. However, this is well-mitigated through the use of clear boundary markers (triple quotes), explicit instructions to the agent to only extract specific JSON fields, and truncation of review text to 500 characters.
- [SAFE]: File system access is limited to the skill's own directory for storing monitoring configuration and baselines (monitor-data/), which does not pose a risk to system integrity or sensitive user data.
Audit Metadata