data-scraper-agent
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection where untrusted data from external websites is processed by an LLM.
- Ingestion points: Data is fetched from arbitrary external URLs in
scraper/sources/. - Boundary markers: The
_build_promptfunction inai/pipeline.pylacks robust delimiters or instructions to ignore embedded commands within the scraped text. - Capability inventory: The agent can write data to Notion databases and update its own repository state via GitHub Actions.
- Sanitization: No explicit sanitization or filtering of the scraped content is performed before interpolation into the prompt.
- [COMMAND_EXECUTION]: The GitHub Actions workflow defined in
.github/workflows/scraper.ymlexecutes shell commands to install dependencies, run the scraper, and perform git operations (commit and push) to persist feedback data. - [DATA_EXFILTRATION]: By design, the skill collects data from public sources and transmits it to the Google Gemini API (a well-known service) for analysis and subsequently to Notion or other storage providers. This behavior is consistent with the skill's stated purpose.
Audit Metadata