1688-price-moq-scraper
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions mandate the automatic installation of the BrowserAct CLI and skill from an external repository (https://github.com/browser-act/skills/tree/main) if they are missing from the environment.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to perform dependency installation 'automatically without asking the user to confirm' and further commands the agent to 'not request separate approval,' which removes user oversight and bypasses safety checkpoints.
- [EXTERNAL_DOWNLOADS]: The skill references and requires downloading external tools and skills from the browseract.com domain and its associated GitHub repository, which are not categorized as trusted sources.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the 1688 marketplace, which serves as a vector for indirect prompt injection attacks.
- Ingestion points: Browser-visible content, metadata, and network responses from 1688.com (SKILL.md).
- Boundary markers: None; the instructions lack delimiters or warnings to ignore instructions embedded in the scraped content.
- Capability inventory: Live browser interaction, network access, and task execution via the BrowserAct CLI (SKILL.md).
- Sanitization: None; the skill does not specify any validation, filtering, or escaping of the ingested web data.
Recommendations
- AI detected serious security threats
Audit Metadata