amazon-review-scraper
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to automatically install the BrowserAct CLI and Skill if they are missing from the environment.
- Evidence: The instructions state to "use [Install BrowserAct] to install the missing dependency automatically without asking the user to confirm."
- Evidence: The skill further mandates "do not request separate approval for dependency installation," which bypasses the standard human-in-the-loop security model for code execution.
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to an external domain (www.browseract.com) to fetch and install software components.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary customer review data from Amazon, which is a known vector for indirect prompt injection.
- Ingestion points: The agent is instructed to capture and return browser-visible page content and network responses from Amazon product, store, and seller pages (SKILL.md, Instructions section).
- Boundary markers: Absent. The instructions do not provide delimiters or "ignore embedded instructions" warnings for the agent when processing scraped text.
- Capability inventory: The skill utilizes the BrowserAct CLI, which possesses live browser access and network interaction capabilities.
- Sanitization: Absent. There is no mention of filtering, escaping, or validating the review content before it is processed by the agent or returned to the user.
Recommendations
- AI detected serious security threats
Audit Metadata