lazyweb-growth-report
Fail
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to run
curl -fsSL https://www.lazyweb.com/install.sh | bash. This is a critical security vulnerability as it allows for the download and execution of arbitrary code from a remote server without any verification or oversight. - [COMMAND_EXECUTION]: The skill requires access to the
Bashtool and uses shell commands to handle installation and health checks, which increases the potential impact of a compromise. - [EXTERNAL_DOWNLOADS]: The skill relies on fetching an installation script from
https://www.lazyweb.com, which is an unverified external source not listed among trusted providers. - [PROMPT_INJECTION]: The skill processes untrusted webpage or product screen data, presenting a surface for indirect prompt injection. 1. Ingestion points: Untrusted data enters the context via parameters passed to the
lazyweb_growth_reporttool. 2. Boundary markers: The instructions do not provide delimiters or security warnings to the agent regarding the handling of content from analyzed pages. 3. Capability inventory: The skill has access to shell execution (Bash) and network-based diagnostic tools. 4. Sanitization: No sanitization or validation of the input content is described.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.lazyweb.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata