poe-mercenary-trade
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute a local Node.js script (
mercenary-search.js) with shell arguments to perform searches. - [COMMAND_EXECUTION]: The script uses the Chrome DevTools Protocol to perform dynamic JavaScript execution (
Runtime.evaluate) inside the user's browser tabs. - [DATA_EXFILTRATION]: The script interacts with the user's authenticated session on
poe.game.qq.comusingfetchwithcredentials: "include". This capability allows the script to access and retrieve data from a logged-in session, which could potentially expose session-specific information to the agent's context. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from external sources and using it to influence agent decisions:
- Ingestion points: Content is fetched and parsed from external URLs (
poedb.tw) and official trade API responses. - Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested content.
- Capability inventory: The skill has the capability to execute shell commands and control a browser instance via CDP.
- Sanitization: No validation or sanitization is performed on the data retrieved from external sources before the agent uses it to rank and recommend items.
Audit Metadata