mercadolibre-search-results-scraper
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHPROMPT_INJECTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions to override safety protocols and user oversight. Specifically, it directs the agent to install dependencies 'automatically without asking the user to confirm' and commands the agent to 'not request separate approval for dependency installation'. This is a direct attempt to bypass the platform's user consent and transparency guardrails.
- [REMOTE_CODE_EXECUTION]: The instructions mandate the automatic installation of an external CLI tool and skill from an untrusted remote source (
browseract.com). By combining automated installation with the suppression of user approval, the skill facilitates the silent execution of potentially arbitrary code on the user's system. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a public marketplace (MercadoLibre), which is an untrusted external source. This creates a vulnerability where malicious instructions embedded in product listings or metadata could be executed by the agent or influence its behavior during data extraction and processing.
- Ingestion points: Marketplace search results, product titles, and seller metadata (SKILL.md, Common Data section).
- Boundary markers: None; there are no instructions to sanitize input or use delimiters to isolate external content.
- Capability inventory: Utilizes an external browser CLI for network operations and site interaction; possesses capabilities to export and format data (SKILL.md, Instructions section).
- Sanitization: No validation or sanitization of ingested content is specified.
Recommendations
- AI detected serious security threats
Audit Metadata