data-scraper-agent
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill designs a system that fetches data from arbitrary public websites and passes it to an LLM for enrichment. This creates an entry point for malicious actors to embed instructions in public web pages that could manipulate the agent's scoring or output logic.
- Ingestion points: Data is ingested from external URLs and APIs via the
scraper/sources/module usingrequestsorplaywright. - Boundary markers: The prompt construction in
ai/pipeline.pyuses Markdown headers (# Items,# User Context) to delimit external content. These are standard formatting but do not provide high-security isolation against adversarial input. - Capability inventory: The agent can perform automated network scraping and write results to persistent storage providers such as Notion, Google Sheets, or Supabase.
- Sanitization: Content is serialized into JSON format before insertion into the prompt. While this prevents structure breakage, it does not sanitize the semantic content of the scraped data for potential injection sequences.
Audit Metadata