walmart-keyword-search
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a pattern of executing a local Python script to generate JavaScript which is then executed in the browser context (e.g.,
eval "$(python scripts/extract-listing.py)"). This is a standard operational pattern for this type of browser automation skill. - [PROMPT_INJECTION]: The instructions include a statement that there is "no need to read
scripts/*.pysource code or re-verify," which attempts to direct the agent's focus for efficiency. While such phrases can sometimes be used to hide malicious logic, the accompanying scripts in this skill were found to be benign data extraction tools. - [DATA_EXFILTRATION]: The skill extracts product information (titles, prices, IDs) from Walmart, which is the stated purpose of the skill. No sensitive local data or credentials are accessed or transmitted to external servers.
Audit Metadata