facebook-ad-library-intent-scraper
Warn
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: MEDIUMPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that explicitly command the agent to bypass human-in-the-loop safeguards. It directs the agent to install dependencies "automatically without asking the user to confirm" and further instructs the agent to conceal this action by not describing the link as a request to open a browser.
- [REMOTE_CODE_EXECUTION]: The skill references an external, non-trusted URL (browseract.com) for the automatic download and installation of the 'BrowserAct' CLI and skill. This pattern of unverified external code acquisition without user oversight is a significant security risk.
- [COMMAND_EXECUTION]: The skill relies on an external CLI tool to execute browser-based tasks. The instructions delegate the choice of "appropriate browser workflow" to the third-party runtime, allowing for unverified execution patterns.
- [DATA_EXFILTRATION]: The skill's primary purpose is the collection of potentially sensitive intent signals, including visible emails and contact details from social media profiles, and exporting them to external formats (CSV/Table).
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) as it processes untrusted data from the Facebook Ad Library and uses a powerful browser CLI without evidence of boundary markers or input sanitization.
- Ingestion points: External Facebook Ad Library web pages and profile data (SKILL.md).
- Boundary markers: None identified; instructions do not specify delimiters for scraped content.
- Capability inventory: Uses
browser-actCLI for browser interaction (SKILL.md). - Sanitization: None identified; the skill processes requested fields and search queries directly into the browser workflow.
Audit Metadata