business-contact-social-links-skill
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The Python script makes network requests to api.browser-act.com to execute workflow templates. This is the intended behavior for this service integration and targets the vendor's official API domain.\n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script to interact with the BrowserAct API and poll for task completion.\n- [CREDENTIALS_UNSAFE]: The skill safely handles the BROWSERACT_API_KEY by retrieving it from environment variables and provides clear instructions for the user to obtain a key from the official console if it is missing.\n- [DATA_EXFILTRATION]: User-supplied company names or URLs are transmitted to the BrowserAct API for link extraction. This is documented as the primary function of the skill and does not involve unauthorized access to local sensitive files.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the web via the BrowserAct API, representing a potential vulnerability surface. \n
- Ingestion points: Data retrieved from external websites is processed in scripts/business_contact_social_links.py.\n
- Boundary markers: The output from the API is returned to the agent without explicit delimiters or instructional warnings.\n
- Capability inventory: The agent can execute a Python script that performs network operations and environment variable access.\n
- Sanitization: No filtering or sanitization is applied to the data fetched from the remote API.
Audit Metadata