amazon-product-info
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The scripts/setup.sh script downloads a setup file from https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh using curl.\n- [REMOTE_CODE_EXECUTION]: The scripts/setup.sh script executes the downloaded file immediately via exec bash. This is a vendor-owned resource but represents a remote execution pattern.\n- [COMMAND_EXECUTION]: The scripts/get_amazon_product_info.sh file executes the frevana binary and python3 for processing Amazon product data.\n- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection by processing external data. \n
- Ingestion points: Product page data retrieved from Amazon URLs.\n
- Boundary markers: Absent; the skill does not use specific delimiters to isolate external content.\n
- Capability inventory: The skill can execute shell commands and write to the local file system.\n
- Sanitization: Basic URL structure is validated via regular expression.
Audit Metadata