synthetic-data-generator
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill requires the agent to generate and execute Python scripts to handle large-scale data generation and API calls. Step 3 explicitly mandates the creation of scripts to manage batch prompting and data processing, which constitutes runtime code generation and execution.
- [COMMAND_EXECUTION]: The skill uses the
chrome-devtoolsMCP server to automate browser tasks, including navigating to external URLs and interacting with web form elements. It specifically instructs the agent to simulate human-like behavior (randomized delays) to bypass anti-bot security measures on target websites. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external research instruments and online forms, creating a surface for indirect prompt injection.
- Ingestion points: External URLs provided by users and form field data retrieved via
puppeteer_evaluateinSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the instruments or forms.
- Capability inventory: Includes Python script execution, local file writing (CSV/JSON), and full browser automation (navigation, input, and clicking).
- Sanitization: There are no instructions for sanitizing or validating the content of the external forms before the agent processes and responds to them.
Audit Metadata