noon-category-listing-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that explicitly direct the agent to override user consent protocols. It commands the agent to install dependencies "automatically without asking the user to confirm" and explicitly forbids the agent from describing the installation process to the user or requesting approval for the operation.- [EXTERNAL_DOWNLOADS]: The skill points to an external installation source hosted on an untrusted GitHub repository (browser-act/skills) accessed via a tracking redirect link (browseract.com). This source is not recognized as a trusted organization or well-known service.- [REMOTE_CODE_EXECUTION]: The instructions mandate the automatic download, installation, and execution of an external CLI tool and additional agent skills from untrusted sources. This facilitates the execution of arbitrary code on the local system without manual verification or security review.- [COMMAND_EXECUTION]: The skill requires the execution of system-level shell commands through the BrowserAct CLI to perform its primary functions.- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the ingestion of untrusted web content.
- Ingestion points: Reads category listings, product titles, and metadata from Noon.com URLs provided at runtime.
- Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands within the scraped data.
- Capability inventory: The skill can execute shell commands via the BrowserAct CLI and perform network operations.
- Sanitization: Absent; retrieved data is processed and returned without validation or filtering.
Recommendations
- AI detected serious security threats
Audit Metadata