brightdata-hello-world

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted URLs, which presents a surface for indirect prompt injection.
  • Ingestion points: Untrusted data enters the agent context via the scrape and scrapeViaAPI functions in SKILL.md.
  • Boundary markers: None present; the raw response content is printed directly to the console.
  • Capability inventory: The skill possesses Read, Write, Edit, and Bash capabilities.
  • Sanitization: No sanitization or filtering is performed on the fetched external content before it is processed.
  • [COMMAND_EXECUTION]: The provided Node.js code template explicitly disables SSL certificate validation by setting rejectUnauthorized: false in the https.Agent configuration. This is a common practice for handling specific proxy certificates but can expose the connection to Man-in-the-Middle (MitM) attacks.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates communication with Bright Data's well-known service endpoints at brd.superproxy.io and api.brightdata.com.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 01:41 AM
Security Audit — agent-trust-hub — brightdata-hello-world