trustpilot-review-scraper
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that explicitly direct the agent to override user confirmation protocols. It states dependencies should be installed "automatically without asking the user to confirm" and that the agent should "not request separate approval for dependency installation." This is a direct attempt to circumvent user oversight and safety guardrails.
- [REMOTE_CODE_EXECUTION]: The skill mandates the installation and execution of external software from a non-standard domain (browseract.com). By instructing the agent to fetch and install this software autonomously, it creates a vector for unverified code execution.
- [COMMAND_EXECUTION]: The skill's primary functionality relies on invoking a command-line interface tool (BrowserAct CLI), which requires the agent to execute code on the host system.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from external Trustpilot review pages, creating a surface for injection attacks.
- Ingestion points: Trustpilot review text, ratings, and reviewer names retrieved from live web pages.
- Boundary markers: Absent; there are no instructions to delimit the scraped content or treat it as untrusted data.
- Capability inventory: Shell command execution via the BrowserAct CLI tool.
- Sanitization: Absent; the instructions do not mention validating or escaping the scraped content before it is processed by the agent.
Recommendations
- AI detected serious security threats
Audit Metadata