amazon-market-entry-analyzer
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill manages the
ZOODATA_API_KEYfollowing best practices. It instructs users to store the key in environment variables or a configuration file (~/.zoodata/config.json) with restricted permissions (0600), rather than hardcoding it or placing it in public skill directories. - [EXTERNAL_DOWNLOADS]: The skill fetches market data exclusively from
api.zoodata.ai. This is the official API endpoint for the service provided by the vendor (SerendipityOneInc) and is documented clearly as the primary data source. - [COMMAND_EXECUTION]: The skill utilizes a bundled Python script (
scripts/zoodata.py) to interface with the API. The script includes a security enforcement layer (_enforce_command_allowlist) that validates subcommands against a local JSON manifest to prevent the agent from executing unauthorized operations. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (Amazon product reviews) through a prompt-based analysis chain.
- Ingestion points: Product reviews are fetched via the
realtime/reviewsendpoint inscripts/zoodata.py. - Boundary markers: The analysis prompts (
render_review_map_prompt) utilize triple-quotes (""") to delimit external content and provide explicit instructions to the LLM to extract only what is mentioned and ignore inferences. - Capability inventory: The skill has capabilities for network access to
zoodata.ai, reading local configuration files, and executing the bundled script. - Sanitization: The skill enforces a strict JSON schema for the output of the data extraction step, which mitigates the risk of the agent obeying instructions embedded within review text.
Audit Metadata