brightdata-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted URLs, which presents a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context via the
scrapeandscrapeViaAPIfunctions inSKILL.md. - Boundary markers: None present; the raw response content is printed directly to the console.
- Capability inventory: The skill possesses
Read,Write,Edit, andBashcapabilities. - Sanitization: No sanitization or filtering is performed on the fetched external content before it is processed.
- [COMMAND_EXECUTION]: The provided Node.js code template explicitly disables SSL certificate validation by setting
rejectUnauthorized: falsein thehttps.Agentconfiguration. This is a common practice for handling specific proxy certificates but can expose the connection to Man-in-the-Middle (MitM) attacks. - [EXTERNAL_DOWNLOADS]: The skill facilitates communication with Bright Data's well-known service endpoints at
brd.superproxy.ioandapi.brightdata.com.
Audit Metadata