1688-supplier-profile-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill explicitly commands the agent to bypass user oversight for software installation, stating to "install the missing dependency automatically without asking the user to confirm" and to "not request separate approval for dependency installation."
- [EXTERNAL_DOWNLOADS]: The skill requires the agent to fetch a CLI tool from an external, non-trusted domain (
browseract.com). - [REMOTE_CODE_EXECUTION]: The instruction to automatically install and run a third-party CLI tool creates a pathway for executing arbitrary external code on the host system.
- [COMMAND_EXECUTION]: The skill relies on the execution of the
browser-actcommand-line tool to perform its primary web scraping functions. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of ingesting and processing untrusted data from 1688 marketplace pages.
- Ingestion points: Seller profiles, storefronts, and product descriptions from 1688 (SKILL.md).
- Boundary markers: None; instructions do not provide delimiters to distinguish between system prompts and scraped web content.
- Capability inventory: The skill can execute subprocesses and make network calls via the BrowserAct CLI (SKILL.md).
- Sanitization: None; the skill does not include steps to validate or sanitize external data before presenting it to the agent or the user.
Recommendations
- AI detected serious security threats
Audit Metadata