third-party-privacy
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (
scripts/observe-runtime.mjs) which drives a headless browser to audit target websites. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from target websites (HTML, cookie names, network hosts). This data is processed locally to generate a privacy report, which the agent then interprets. While this represents an attack surface, the risk is mitigated by the tool's focus on identifying known vendors and the fact that the data is not directly interpolated into sensitive instructions.
- [DATA_EXFILTRATION]: The skill captures information from audited sites, such as cookies and storage. This behavior is the primary intended function of the privacy audit and the results are reported to the user.
- [EXTERNAL_DOWNLOADS]: The skill attempts to use a locally installed
playwrightorplaywright-corepackage. It does not perform unexpected remote downloads.
Audit Metadata