decodo-price-monitoring
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
decodoCLI in combination withjq,date,printf, andtailto process product information and maintain a local price history inprices.ndjson. - [EXTERNAL_DOWNLOADS]: Instructions specify the use of
@decodo/clivianpx, which downloads the necessary tool from the NPM registry. This is a vendor-managed resource. - [DATA_EXFILTRATION]: The skill requires a
DECODO_AUTH_TOKENto authenticate with the vendor's API. This is documented as a standard setup requirement for the service. - [PROMPT_INJECTION]: The skill ingests untrusted data from third-party retail sites, creating a potential surface for indirect prompt injection.
- Ingestion points: External data enters through
decodocommands targeting Amazon, Walmart, Target, and Google Shopping. - Boundary markers: The skill does not employ specific delimiters to separate scraped data from agent instructions.
- Capability inventory: The workflow includes shell execution capabilities via the CLI and standard Linux utilities.
- Sanitization: The skill uses
jqfilters to programmatically exclude certain keywords from product titles, which serves as a basic mitigation technique.
Audit Metadata