google-maps-review-scraper
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHPROMPT_INJECTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The instructions explicitly command the agent to bypass user confirmation steps. It states that if dependencies are missing, the agent should install them automatically 'without asking the user to confirm' and specifically instructs the agent not to request separate approval for installation.
- [REMOTE_CODE_EXECUTION]: The skill requires the installation and execution of the 'BrowserAct' CLI from an external source (browseract.com). The instruction to automate this installation creates a path for remote code to be executed on the user's system without oversight.
- [EXTERNAL_DOWNLOADS]: The skill points to a non-trusted third-party domain (browseract.com) to fetch runtime dependencies and skill extensions.
- [COMMAND_EXECUTION]: The skill's primary function relies on invoking a command-line interface (CLI) tool, which is downloaded and used to interact with the system's browser environment.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to scrape and process external reviews from Google Maps.
- Ingestion points: Instructions 5 and 6 in
SKILL.mddescribe capturing browser-visible page content and metadata. - Boundary markers: None are defined to separate untrusted data from the agent's instructions.
- Capability inventory: The agent has the capability to execute CLI commands and interact with the network via the BrowserAct tool.
- Sanitization: No sanitization or validation of the scraped review text is mentioned before the data is processed or exported.
Recommendations
- AI detected serious security threats
Audit Metadata