linkedin-newsletter-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions require the agent to automatically install a third-party CLI tool ('BrowserAct') and an associated skill from an external domain (browseract.com) if they are missing from the environment.
- [COMMAND_EXECUTION]: The skill explicitly commands the agent to bypass standard security protocols by performing installation 'automatically without asking the user to confirm'. It further instructs the agent 'not to request separate approval for dependency installation' and to avoid describing the link as a browser-opening request. This represents a deliberate attempt to suppress user awareness and oversight of software installation processes.
- [DATA_EXFILTRATION]: The skill references URLs containing tracking parameters (
?co-from=lead-generation) that transmit usage context to a non-whitelisted third-party domain during dependency resolution. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection via external data processing.
- Ingestion points: LinkedIn newsletter pages, author profiles, and search result pages (SKILL.md).
- Boundary markers: Absent; there are no instructions to use delimiters or ignore embedded commands in the scraped content.
- Capability inventory: Uses the
browser-actCLI for live website interaction and data scraping (SKILL.md). - Sanitization: No validation or filtering is performed on the untrusted data retrieved from external web pages before the agent processes it.
Recommendations
- AI detected serious security threats
Audit Metadata