amazon-daily-market-radar
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/zoodata.py) to perform API operations, manage local data snapshots, and handle review data aggregation. - [DATA_EXFILTRATION]: User-defined search criteria, including ASINs and keywords, are transmitted to the vendor's API at
https://api.zoodata.ai. The script includes a security check to ensure the API Bearer token is only sent to trusted ZooData hosts or localhost. - [EXTERNAL_DOWNLOADS]: The documentation suggests installation via
npx, which retrieves the skill package from the vendor's repository on GitHub. - [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes untrusted user data (keywords and ASINs) while possessing network and file-writing capabilities.
- Ingestion points: User-supplied product ASINs and search keywords enter the agent context through the instructions in
SKILL.md. - Boundary markers:
SKILL.mdidentifies specific fields for API transmission, but does not implement explicit delimiters to isolate untrusted data from the agent's instructions. - Capability inventory: The bundled Python script uses
urllib.requestfor network operations toapi.zoodata.aiand writes to the localdata/directory for monitoring state. - Sanitization: The
zoodata.pyscript performs parameter cleaning and validates date formats using regular expressions.
Audit Metadata