dynamic-content-extraction
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains meta-instructions that attempt to influence the agent's internal tool-selection logic by prioritizing runtime tool catalog checks over static notes and referencing a 'vault' for web tooling. It is also susceptible to indirect prompt injection: 1. Ingestion points: Extracts data from external websites such as Booking.com, Marriott, and Amazon (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Possesses browser automation tools capable of network requests (fetch), script execution (browser_console), and low-level browser control (browser_cdp). 4. Sanitization: Absent.
- [COMMAND_EXECUTION]: The skill relies on executing arbitrary JavaScript snippets through
browser_consoleandbrowser_cdpto interact with the DOM and perform extraction tasks. - [DATA_EXFILTRATION]: Provides instructions to access and potentially exfiltrate sensitive session data using
Network.getAllCookiesand to reproduce internal API requests usingfetch()within the browser console environment. - [REMOTE_CODE_EXECUTION]: The workflow relies on dynamic code generation and execution, providing specific JavaScript snippets for runtime injection via
Runtime.evaluateto handle complex web framework rendering.
Audit Metadata