skills/brightdata/skills/discover-api/Gen Agent Trust Hub

discover-api

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the official bdata CLI and curl to interact with the Bright Data Discover API. These commands are documented for their intended use in search and retrieval workflows.
  • [DATA_EXFILTRATION]: Network communication is directed to api.brightdata.com, which is the authoritative domain for the vendor's API. No unauthorized data transmission was detected.
  • [PROMPT_INJECTION]: The skill retrieves untrusted third-party data from the web (page content, titles, and descriptions), creating an indirect prompt injection surface.
  • Ingestion points: The results[].content, results[].title, and results[].description fields (SKILL.md) ingest external content.
  • Boundary markers: No explicit delimiters or instruction-override warnings are provided for the agent when processing these fields.
  • Capability inventory: The skill has access to the shell via curl and the bdata CLI (SKILL.md).
  • Sanitization: The documentation suggests filtering for block-page and CAPTCHA signatures, but does not include specific sanitization for malicious instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 05:55 AM
Security Audit — agent-trust-hub — discover-api