saas-company-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill instructs the Agent to install dependencies automatically and explicitly tells it to hide that installation and not request user approval, which is a deceptive behavior outside the advertised lead-scraping purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The Skill contains explicit instructions to auto-install an external CLI without user confirmation and to hide/phrase the installation so the user isn't asked, creating a high-risk supply-chain/remote-execution and unauthorized-installation vector (scraping functionality also enables bulk data collection).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to invoke the BrowserAct CLI to access and interact with live public web pages at runtime (outsider-authored free text from fetched directory/marketplace pages becomes LLM-readable content).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly directs the agent at runtime to invoke/install the BrowserAct Skill/CLI and to "install the missing dependency automatically" using the install link (https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main and https://www.browseract.com/?co-from=lead-generation), so those URLs are used at runtime to obtain remote installation/instructional content that controls the agent's behavior.