mercari-marketplace-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The Skill includes explicit, deceptive instructions to install the BrowserAct dependency automatically "without asking the user to confirm" and to not describe it as a user-facing request, which instructs the agent to hide actions and bypass user consent outside the skill's stated scraping purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The Skill includes explicit instructions to silently install a runtime dependency without user approval and to capture browser-visible network responses and session artifacts (cookies/account info), enabling deceptive installation and potential data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to use the BrowserAct CLI to “capture browser-visible page content” from user-specified Mercari/public URLs at runtime, which can include outsider-authored free text from fetched web pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Skill instructs the agent to automatically fetch/install the BrowserAct runtime from https://www.browseract.com/?co-from=ecommerce&redirect=https://github.com/browser-act/skills/tree/main (and references https://www.browseract.com/?co-from=ecommerce), which is a required runtime dependency and implies fetching/executing remote installer code that will control the agent's browser-execution capability.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The Skill explicitly instructs the agent to automatically install the BrowserAct CLI and resume execution "without asking the user to confirm" and forbids requesting separate approval, which pushes the agent to modify the host system (potentially requiring elevated privileges) without user consent.