faire-brand-scraper
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to bypass user confirmation for security-sensitive actions. Specifically, it tells the agent to "install the missing dependency automatically without asking the user to confirm" and "do not request separate approval for dependency installation."- [REMOTE_CODE_EXECUTION]: The instructions mandate the automatic installation of a third-party CLI tool and skills from an external source (browser-act.com and a redirect to GitHub) when missing, which constitutes remote code acquisition and execution from an unverified source.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites (Faire), creating a surface for instructions hidden in scraped content to influence the agent.
- Ingestion points: Captures content from Faire seller profiles, category pages, and storefronts in SKILL.md.
- Boundary markers: None. No instructions are provided to the agent to treat scraped content as data rather than instructions.
- Capability inventory: The skill utilizes the browser-act tool for network access and storefront interaction, and instructions mention exporting research tables to the filesystem.
- Sanitization: None. The skill instructs the agent to capture and return browser-visible page content directly.
Recommendations
- AI detected serious security threats
Audit Metadata