amazon-listing-competitor-analysis-skill

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes a local Python script to perform API interactions. This is limited to the defined functionality and does not allow for arbitrary command injection.- [EXTERNAL_DOWNLOADS]: Network requests are directed to api.browseract.com, which is the official API domain for the tool's developer, browser-act. These communications are necessary for the skill's function.- [CREDENTIALS_UNSAFE]: The skill utilizes the BROWSERACT_API_KEY environment variable for authentication, which is a secure practice. It explicitly guides users to set this variable if it is missing.- [DATA_EXFILTRATION]: No sensitive local files or data are transmitted. The script only sends the target Amazon ASIN and marketplace URL to the scraping service.- [PROMPT_INJECTION]: The skill ingests untrusted data from external Amazon listings.
  • Ingestion points: Product data (titles, bullets, reviews) entering through scripts/amazon_listing_competitor_analysis.py.
  • Boundary markers: The SKILL.md defines a structured framework for Phase 2 analysis, though it lacks explicit technical delimiters for external data.
  • Capability inventory: The skill's capabilities are limited to the specific API script execution.
  • Sanitization: The skill does not perform specific sanitization, but relies on its structured analysis framework to focus on data facts rather than instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 10:44 AM