paw-mkt-sostac
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
agent-browserutility from the Vercel Labs GitHub organization, which is a recognized and trusted source for development tooling. - [COMMAND_EXECUTION]: Shell commands are used to automate web research and install necessary browser dependencies (Playwright). These operations are transparently documented and scoped to the intended functionality of the skill.
- [DATA_EXFILTRATION]: While the skill performs web research and stores data in a local
.pawbytesdirectory, there is no evidence of unauthorized data transfer to external servers. Authenticated session management is handled with security best practices, including advice to ignore session files in version control. - [PROMPT_INJECTION]: The skill processes untrusted data from external websites (Reddit, Quora, and competitor sites) to generate marketing insights. While this creates a potential surface for indirect prompt injection, the risk is mitigated by mandatory human-in-the-loop (HITL) gates. The agent is strictly prohibited from auto-advancing, ensuring that the user reviews and validates all research findings before they are finalized.
Audit Metadata