noon-review-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The Skill includes explicit instructions to auto-install a dependency without asking the user and to conceal that installation request ("do not describe it as a request" / "do not request separate approval"), which are deceptive/hidden directives outside the legitimate scraping purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The Skill instructs automatic, non-consensual installation of an external CLI and explicitly directs concealment from the user while also capturing browser-visible network responses and session artifacts, creating a high risk of supply-chain installation and unauthorized data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to use the BrowserAct CLI to “access real browser pages” and “capture browser-visible page content” from user-specified Noon URLs at runtime, which can include outsider-authored review text and other free-form content that the LLM ingests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs the agent to automatically use the Install BrowserAct link at runtime to install a required CLI/Skill, meaning the agent will fetch and execute remote code from https://www.browseract.com/?co-from=ecommerce&redirect=https://github.com/browser-act/skills/tree/main to obtain that dependency.