sg-fruit-price-tracker-skill

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs legitimate price tracking by scraping publicly available data from official Singapore supermarket domains (coldstorage.com.sg and fairprice.com.sg). It employs robust validation, including a 70+ keyword blocklist to filter out non-fruit products and strict price range checks ($0.50 to $200) to ensure data integrity.
  • [COMMAND_EXECUTION]: Static analysis identified subprocess.run calls in the tests/test_fruit_price_tracker.py and evals/grade.py files. These are benign and limited to executing the skill's own Python script within a controlled environment for automated testing and grading. The primary runtime script (scripts/fruit_price_tracker.py) does not use subprocess, os.system, or any other shell-execution functions.
  • [EXTERNAL_DOWNLOADS]: The script uses urllib.request to fetch HTML content from supermarket websites. These operations are restricted to well-known retail domains and use standard HTTP headers, including a specific User-Agent, adhering to its stated scraping purpose.
  • [DATA_EXFILTRATION]: There is no evidence of unauthorized data transfer. The script processes supermarket data locally, manages a local disk cache in the user's home directory, and outputs results via standard output (CSV/JSON).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 05:42 AM
Security Audit — agent-trust-hub — sg-fruit-price-tracker-skill