data-scraper-agent
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The automated feedback system commits data back to the repository. The provided GitHub Actions workflow (
.github/workflows/scraper.yml) is configured to commit and pushdata/feedback.jsonafter every run. Since the skill is designed to run in public repositories to utilize free GitHub Actions, any sensitive data captured during scraping or stored in user feedback history would be publicly exposed. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its data ingestion pipeline.
- Ingestion points: Untrusted data is fetched from external URLs via
requestsorplaywrightwithin thescraper/sources/directory. - Boundary markers: The
ai/pipeline.pyscript uses JSON serialization for items but lacks explicit boundary markers or instructions to the LLM to ignore embedded commands within the scraped content. - Capability inventory: The agent has the ability to perform network operations (Notion/Supabase APIs), execute code (Playwright/Python), and write to the local file system.
- Sanitization: No sanitization or filtering is performed on external content before it is interpolated into the prompt provided to the Gemini model.
Audit Metadata