linkfox-youying-shopee-get-product-infos
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted product information (titles and descriptions) from the Shopee marketplace, creating a surface for indirect prompt injection where malicious instructions embedded in product listings could potentially influence agent behavior.
- Ingestion points:
scripts/youying_shopee_search.pyfetches product data from external Shopee listings via the vendor API. - Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings used when presenting the product data to the agent.
- Capability inventory: The skill has the capability to perform network requests to vendor domains and write data to the local file system.
- Sanitization: No explicit sanitization, validation, or filtering of the external product content is performed in the scripts before processing.
Audit Metadata