amazon-deal-finder
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites (Amazon, Shopify, and other e-commerce platforms) using the
web_fetchtool to analyze promotion details. This creates a surface where malicious instructions could be embedded in the fetched content, potentially influencing the agent's behavior. - Ingestion points: The skill fetches promotional data, fee structures, and market information from Amazon promotion pages and other supported platforms as described in
SKILL.mdandREADME_CN.md. - Boundary markers: The instructions do not define specific delimiters or security headers to separate untrusted external content from the agent's core instructions.
- Capability inventory: The skill is restricted to research and providing analysis; it does not contain instructions for file system modifications, arbitrary command execution, or unauthorized network exfiltration.
- Sanitization: There are no explicit instructions to sanitize or validate the content retrieved via
web_fetchbefore it is processed by the agent.
Audit Metadata