ebay-price-comps-research

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The Skill explicitly directs automatic installation of an external runtime without user consent and instructs not to disclose that action, while also permitting capture of browser-visible network responses — behavior that deliberately circumvents user approval and could enable supply-chain or data-exfiltration abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to use the BrowserAct CLI to “capture browser-visible page content” from user-specified eBay/public URLs at runtime, which can include outsider-authored free text from those pages (public web content injection risk).