fetch-listing

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill's setup instructions and documentation include standard shell commands for Node.js environment management (nvm use 24) and package installation (npm install). The skill execution pattern uses node scripts/ali-fetch.mjs to trigger the scraping logic.
  • [EXTERNAL_DOWNLOADS]: The skill uses npm install to download dependencies, including puppeteer, which downloads a local version of Chromium (~150 MB). It also makes a network request to api.frankfurter.app to fetch live currency exchange rates (USD to ILS) for VAT calculations.
  • [SAFE]: The core functionality relies on the aliexpress-product-scraper library to perform automated browsing via Puppeteer. The script accesses only the product ID or URL provided by the user and writes the resulting data to a local outputs/ directory. No sensitive user credentials or system files are accessed or transmitted.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 08:03 AM
Security Audit — agent-trust-hub — fetch-listing