fetch-listing
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill's setup instructions and documentation include standard shell commands for Node.js environment management (
nvm use 24) and package installation (npm install). The skill execution pattern usesnode scripts/ali-fetch.mjsto trigger the scraping logic. - [EXTERNAL_DOWNLOADS]: The skill uses
npm installto download dependencies, includingpuppeteer, which downloads a local version of Chromium (~150 MB). It also makes a network request toapi.frankfurter.appto fetch live currency exchange rates (USD to ILS) for VAT calculations. - [SAFE]: The core functionality relies on the
aliexpress-product-scraperlibrary to perform automated browsing via Puppeteer. The script accesses only the product ID or URL provided by the user and writes the resulting data to a localoutputs/directory. No sensitive user credentials or system files are accessed or transmitted.
Audit Metadata