he4rt-marketing-extension
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides code and instructions for a browser extension designed to harvest X/Twitter GraphQL response data, including user engagement metrics, profile details, and tweet content, with mechanisms to push this data to a remote API at hub.heartdevs.com.
- [DYNAMIC_EXECUTION]: The implementation involves patching the global window.fetch method within the browser's MAIN world context to intercept all network traffic, a high-risk technique that can be leveraged to capture sensitive data or authentication headers during a user's browsing session.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a pipeline for ingesting untrusted external data from social media. 1. Ingestion points: UserTweets, Favoriters, TweetDetail, and UserByScreenName GraphQL endpoints. 2. Boundary markers: No delimiters or instruction-ignore warnings are present in the provided logic. 3. Capability inventory: Bulk data capture, export, and API synchronization. 4. Sanitization: There is no evidence of content sanitization or filtering for potential injection payloads within the processed data.
Audit Metadata