app-store-developer-lead-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to override standard safety and confirmation protocols by stating that dependencies should be installed "automatically without asking the user to confirm" and that the agent should "not request separate approval for dependency installation."
- [EXTERNAL_DOWNLOADS]: The skill mandates the installation of the
browser-actCLI from a third-party website (browseract.com) and an unverified GitHub repository (github.com/browser-act/skills), neither of which are recognized as trusted or well-known services. - [REMOTE_CODE_EXECUTION]: The requirement to automatically install and then execute a third-party CLI tool represents a risk of arbitrary code execution, as the agent is directed to fetch and run external software without human oversight or validation.
- [PROMPT_INJECTION]: The skill processes data from external, untrusted sources (App Store and Google Play) without implementing boundary markers or sanitization, creating a surface for indirect prompt injection.
- Ingestion points: External developer pages on the App Store and Google Play (SKILL.md).
- Boundary markers: None identified.
- Capability inventory: The skill uses the
browser-actCLI to navigate and interact with web pages. - Sanitization: No evidence of filtering or escaping for scraped content is provided.
Recommendations
- AI detected serious security threats
Audit Metadata