google-maps-review-lead-research
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions to override agent safety constraints by directing it to install dependencies 'automatically without asking the user to confirm' and 'do not request separate approval'. This is a direct attempt to bypass standard human-in-the-loop security protocols.\n- [EXTERNAL_DOWNLOADS]: The instructions require the agent to fetch and install the 'BrowserAct' CLI from an external, non-trusted URL (browseract.com) and a third-party GitHub repository.\n- [REMOTE_CODE_EXECUTION]: By requiring the agent to automatically install and then invoke a CLI tool from an external source without user verification, the skill enables the execution of unverified remote code on the local environment.\n- [COMMAND_EXECUTION]: The requirement to 'install the missing dependency automatically' implies the execution of shell commands (e.g., npm install, pip install, or curl|bash) with high autonomy.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core function of processing untrusted web content.\n
- Ingestion points: Google Maps business listings and reviewer-generated text (name, review body, signals) retrieved via BrowserAct.\n
- Boundary markers: None identified; instructions do not provide delimiters or warnings to ignore instructions embedded in the retrieved review data.\n
- Capability inventory: Subprocess execution via BrowserAct CLI and file-system write operations (CSV/table export).\n
- Sanitization: No validation or escaping of external review content is specified before processing or output generation.
Recommendations
- AI detected serious security threats
Audit Metadata