poe-mercenary-trade

Warn

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the agent to execute a local Node.js script (mercenary-search.js) with shell arguments to perform searches.
  • [COMMAND_EXECUTION]: The script uses the Chrome DevTools Protocol to perform dynamic JavaScript execution (Runtime.evaluate) inside the user's browser tabs.
  • [DATA_EXFILTRATION]: The script interacts with the user's authenticated session on poe.game.qq.com using fetch with credentials: "include". This capability allows the script to access and retrieve data from a logged-in session, which could potentially expose session-specific information to the agent's context.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from external sources and using it to influence agent decisions:
  • Ingestion points: Content is fetched and parsed from external URLs (poedb.tw) and official trade API responses.
  • Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested content.
  • Capability inventory: The skill has the capability to execute shell commands and control a browser instance via CDP.
  • Sanitization: No validation or sanitization is performed on the data retrieved from external sources before the agent uses it to rank and recommend items.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 11, 2026, 02:16 PM
Security Audit — agent-trust-hub — poe-mercenary-trade