story-long-scan
Warn
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates and executes JavaScript code at runtime within a browser instance via the Chrome DevTools Protocol (CDP). This is handled through the evalJSONBase64 function in scripts/cdp-utils.js, which is used across all scraper scripts to extract data from target websites.
- [COMMAND_EXECUTION]: The skill uses child_process.execFileSync to execute the agent-browser CLI tool. This is used to open URLs and manage browser sessions for scraping purposes.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes text data from various external web novel platforms (Qidian, Fanqie, JJWXC, Ciweimao, and Qimao). Since this data is then analyzed by the AI, it presents a surface for indirect prompt injection if malicious content is embedded in the scraped titles or synopses.
Audit Metadata