data-scraper-agent
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill architecture ingests untrusted data from arbitrary web sources and processes it using an LLM, creating a potential surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the context from external websites scraped via
requestsorplaywrightinscraper/sources/, as well as from theprofile/context.mdanddata/feedback.jsonfiles. - Boundary markers: The prompt construction logic in
ai/pipeline.pylacks explicit delimiters or structural markers to distinguish between system instructions and the untrusted scraped content. - Capability inventory: The proposed agent has network access capabilities via
requests, the ability to write to external APIs (Notion/Sheets/Supabase), and repository write access through GitHub Actions workflow permissions (contents: write). - Sanitization: The skill does not implement or suggest sanitization, filtering, or escaping mechanisms for external content before it is passed to the Gemini model.
Audit Metadata