google-trends
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of
playwrightandchromium. These are well-known, trusted tools maintained by Microsoft for browser automation. - [COMMAND_EXECUTION]: The skill executes
scripts/scraper.py, a bundled script that automates a browser to fetch trend data. This behavior is consistent with the skill's purpose. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests and processes data from an external source (Google Trends).
- Ingestion points: Data is fetched from
trends.google.cominternal APIs byscripts/scraper.pyand saved as JSON. - Boundary markers: Absent; the instructions in
SKILL.mddo not specify delimiters to isolate the scraped content from the agent's instructions. - Capability inventory: The skill possesses the capability to execute a local Python script, write data to the filesystem, and perform network operations.
- Sanitization: The script provides structural validation by stripping XSSI prefixes and parsing the captured content as JSON.
Audit Metadata