etsy-shop-catalog
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a pattern where a local Python script generates JavaScript code which is then executed via shell evaluation (
eval "$(python scripts/extract-listings.py)"). This represents dynamic execution of code generated from a local template. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from an external, untrusted source (Etsy.com). Product titles, shop names, and badges are extracted from the DOM and processed by the agent.
- Ingestion points: Product card titles, shop names, and rank badges extracted in
scripts/extract-listings.py. - Boundary markers: None identified; instructions do not provide delimiters to separate external data from system instructions.
- Capability inventory: The agent has access to the
browser-acttool, which allows full browser navigation and interaction. - Sanitization: The extraction script performs basic whitespace normalization and text cleaning, but does not provide instruction-level sanitization to prevent adversarial text from influencing the LLM.
- [DATA_EXFILTRATION]: While the skill reads data from Etsy, it does not show patterns of exfiltrating sensitive local information (like credentials or environment variables) to external domains. All data remains within the tool's standard output stream.
Audit Metadata