amazon-reviews-api-skill
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with the official BrowserAct API at
api.browseract.comto perform its intended function of review extraction. This is a legitimate vendor resource for the 'browser-act' author. - [SAFE]: Sensitive API credentials are appropriately handled through the
BROWSERACT_API_KEYenvironment variable, preventing hardcoded secret exposure. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external review data from Amazon. While this presents an ingestion surface (monitored in
scripts/amazon_reviews_api.py), the skill lacks exploitable capabilities as it only prints the structured output to the console, making the risk negligible. - [EXTERNAL_DOWNLOADS]: The script uses the standard
requestslibrary for network operations, which is common for API integrations.
Audit Metadata