google-shopping-merchant-offers-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions explicitly direct the agent to override standard safety protocols by performing installations without user interaction. Evidence includes phrases such as "install the missing dependency automatically without asking the user to confirm" and "do not request separate approval for dependency installation."
- [EXTERNAL_DOWNLOADS]: The skill mandates the download and installation of dependencies from an external, untrusted domain (
browseract.com) and a non-whitelisted GitHub repository (github.com/browser-act/skills). This creates a significant supply chain risk where the agent could be coerced into installing malicious code. - [COMMAND_EXECUTION]: The skill relies on the execution of the
browser-actCLI, an external third-party tool. The instructions for silent, automatic installation of this CLI increase the risk of arbitrary command execution on the host system. - [INDIRECT_PROMPT_INJECTION]: As a scraper for Google Shopping, the skill is designed to ingest large amounts of untrusted third-party data.
- Ingestion points: Web content scraped from merchant offer pages (titles, descriptions, promotion text).
- Boundary markers: None identified in the provided instructions to protect the agent from embedded malicious commands in the scraped data.
- Capability inventory: The skill uses the
browser-actCLI which allows for broader system interactions. - Sanitization: There are no instructions for sanitizing or escaping the scraped content before processing.
Recommendations
- AI detected serious security threats
Audit Metadata