decodo-price-monitoring

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the decodo CLI in combination with jq, date, printf, and tail to process product information and maintain a local price history in prices.ndjson.
  • [EXTERNAL_DOWNLOADS]: Instructions specify the use of @decodo/cli via npx, which downloads the necessary tool from the NPM registry. This is a vendor-managed resource.
  • [DATA_EXFILTRATION]: The skill requires a DECODO_AUTH_TOKEN to authenticate with the vendor's API. This is documented as a standard setup requirement for the service.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from third-party retail sites, creating a potential surface for indirect prompt injection.
  • Ingestion points: External data enters through decodo commands targeting Amazon, Walmart, Target, and Google Shopping.
  • Boundary markers: The skill does not employ specific delimiters to separate scraped data from agent instructions.
  • Capability inventory: The workflow includes shell execution capabilities via the CLI and standard Linux utilities.
  • Sanitization: The skill uses jq filters to programmatically exclude certain keywords from product titles, which serves as a basic mitigation technique.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 09:37 AM
Security Audit — agent-trust-hub — decodo-price-monitoring