marketplace-purchase-vetting
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were identified in the skill instructions or scraping logic. The skill follows best practice guidelines for vetting high-value purchases and identifying common marketplace scams.
- [COMMAND_EXECUTION]: The skill utilizes
Runtime.evaluatevia the Chrome DevTools Protocol to run a specific, static JavaScript snippet for extracting listing data from the browser's DOM. This is a routine operation for scraping within an agent's environment and is not used to execute arbitrary shell commands. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted data from external sources.
- Ingestion points: Marketplace listing descriptions and titles scraped from Facebook and Craigslist.
- Boundary markers: None identified in the scraping logic.
- Capability inventory: Limited to browser navigation and DOM evaluation; no file-system access or arbitrary shell execution capabilities are utilized.
- Sanitization: No specific sanitization or filtering of the ingested text is performed before processing.
Audit Metadata