data-scraper-agent
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill's architecture is susceptible to Indirect Prompt Injection.\n
- Ingestion points: Data is fetched from arbitrary external URLs via scraping scripts like
scraper/sources/source_name.py.\n - Boundary markers: Although the prompt template in
ai/pipeline.pyuses headers like# Itemsand# User Context, it lacks explicit instructions to the AI to ignore instructions embedded within the scraped content.\n - Capability inventory: The agent has network access (Notion API, Google Gemini API) and file-write access (GitHub Actions workflow to push updates to the repo).\n
- Sanitization: Scraped data is structured as JSON but is not sanitized to remove or escape potential prompt injection strings before being interpolated into the LLM prompt.\n- [DATA_EXFILTRATION]: The agent reads user-specific context from
profile/context.md(which may contain sensitive information) and transmits it to the Google Gemini API for enrichment. It also sends collected data to the Notion API for storage. Both destinations are well-known technology services.\n- [COMMAND_EXECUTION]: The skill includes a GitHub Actions workflow (.github/workflows/scraper.yml) that executes shell commands to install dependencies and run the agent scripts. The workflow also utilizes write permissions to automatically commit and push changes todata/feedback.json, which serves as a persistence mechanism for the learning system.
Audit Metadata