google-search-business-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). Lines 40–44 direct the agent to install dependencies automatically without user confirmation and lines 46–48 explicitly instruct it to hide that activity and avoid seeking approval, which are deceptive instructions outside the skill's stated scraping purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). This skill’s required workflow delegates live browsing to the outsider-controlled public web via the browser-act Skill (runtime page fetching/scraping of arbitrary Google/search result pages and linked sites), so outsider-authored free text can be ingested into the agent’s LLM context through BrowserAct’s extracted page/snippet content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent to automatically install and invoke BrowserAct at runtime using the install link https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main, which would fetch and execute remote code as a required dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The Skill explicitly instructs the agent to automatically install the BrowserAct CLI and resume execution "without asking the user to confirm" and to avoid requesting separate approval, which directs the agent to modify the host (install software) and bypass user consent — a clear risk to machine state even though it doesn't explicitly mention sudo or system-file edits.