saas-marketplace-lead-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that explicitly direct the agent to bypass user consent and standard verification steps. Specifically, it tells the agent to install dependencies 'automatically without asking the user to confirm' and to 'not request separate approval for dependency installation'.
- [EXTERNAL_DOWNLOADS]: The skill mandates the installation of a third-party CLI tool from an external source (browseract.com) that is not identified as a trusted or well-known service. This involves fetching and running external code to set up the runtime environment.
- [COMMAND_EXECUTION]: The instruction to 'install the missing dependency automatically' requires the agent to execute shell commands to download and configure software, which is performed without user oversight or authorization for the specific commands used.
- [PROMPT_INJECTION]: The skill is designed to scrape and process untrusted data from SaaS marketplaces, creating an indirect prompt injection attack surface.
- Ingestion points: Data extracted from marketplaces like G2 or Capterra (SKILL.md).
- Boundary markers: Absent; there are no instructions to ignore or delimit instructions found within the scraped content.
- Capability inventory: The skill uses the browser-act tool for browser interaction and website navigation.
- Sanitization: Absent; no validation or filtering of the scraped content is specified before processing.
Recommendations
- AI detected serious security threats
Audit Metadata