amazon-listing-competitor-analysis-skill
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python script to perform API interactions. This is limited to the defined functionality and does not allow for arbitrary command injection.- [EXTERNAL_DOWNLOADS]: Network requests are directed to
api.browseract.com, which is the official API domain for the tool's developer, browser-act. These communications are necessary for the skill's function.- [CREDENTIALS_UNSAFE]: The skill utilizes theBROWSERACT_API_KEYenvironment variable for authentication, which is a secure practice. It explicitly guides users to set this variable if it is missing.- [DATA_EXFILTRATION]: No sensitive local files or data are transmitted. The script only sends the target Amazon ASIN and marketplace URL to the scraping service.- [PROMPT_INJECTION]: The skill ingests untrusted data from external Amazon listings. - Ingestion points: Product data (titles, bullets, reviews) entering through
scripts/amazon_listing_competitor_analysis.py. - Boundary markers: The
SKILL.mddefines a structured framework for Phase 2 analysis, though it lacks explicit technical delimiters for external data. - Capability inventory: The skill's capabilities are limited to the specific API script execution.
- Sanitization: The skill does not perform specific sanitization, but relies on its structured analysis framework to focus on data facts rather than instructions.
Audit Metadata