ecommerce-product-image-reference-scraper
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHPROMPT_INJECTIONREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions to override agent safety protocols by mandating that the agent install external dependencies "automatically without asking the user to confirm." It further instructs the agent to "not request separate approval for dependency installation," which is a direct attempt to bypass user-consent guardrails.\n- [REMOTE_CODE_EXECUTION]: The skill directs the agent to download and install external software (the BrowserAct CLI) from a non-trusted external domain (
browseract.com) at runtime. Automatic installation of unverified software from the internet poses a high risk of malicious code execution.\n- [PRIVILEGE_ESCALATION]: By attempting to perform software installations silently and skipping mandatory approval steps, the skill seeks to escalate its operational privileges and bypass the typical restrictions placed on agent autonomy.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest data from external ecommerce websites, creating a vulnerability surface where untrusted content could influence agent behavior.\n - Ingestion points: SKILL.md describes taking a target URL or search query to browse external pages.\n
- Boundary markers: No delimiters or warnings are provided to help the agent distinguish between its instructions and the data it scrapes.\n
- Capability inventory: The skill has the ability to install tools and perform network operations via BrowserAct.\n
- Sanitization: There are no instructions for sanitizing or filtering data retrieved from external sources before it enters the agent context.
Recommendations
- AI detected serious security threats
Audit Metadata