etsy-trending-products-scraper
Warn
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions provide a link to a third-party website to fetch and install missing dependencies at runtime.
- [REMOTE_CODE_EXECUTION]: The skill directs the agent to automatically install the BrowserAct CLI and associated skills if they are not detected on the system, specifically instructing the agent to do so without asking the user to confirm or describing it as a request to the user.
- [COMMAND_EXECUTION]: The skill relies on the execution of a third-party command-line interface (CLI) to perform browser automation tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external Etsy web pages, which is a vulnerability surface for malicious instructions embedded in scraped data.
- Ingestion points: Etsy ranking pages, product pages, and search results (SKILL.md).
- Boundary markers: No delimiters or ignore-instructions warnings are present for the scraped data.
- Capability inventory: Browser automation via CLI and network access.
- Sanitization: No explicit sanitization or validation of the scraped content is performed before the agent processes it.
Audit Metadata