website-case-study-lead-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to automatically download the BrowserAct CLI and associated skill dependencies from an external domain and GitHub repository that are not recognized as trusted sources.
- [REMOTE_CODE_EXECUTION]: The skill contains instructions to 'install the missing dependency automatically,' which involves fetching and executing code from a remote source if the tools are not already present.
- [COMMAND_EXECUTION]: The skill attempts to bypass security boundaries by instructing the agent to 'not request separate approval for dependency installation' and to not describe the installation process to the user, leading to autonomous and unverified command execution.
- [PROMPT_INJECTION]: The skill is designed to scrape and process content from arbitrary external websites, which presents a surface for indirect prompt injection. 1. Ingestion points: Data collected from target URLs during lead scraping. 2. Boundary markers: None provided to distinguish between content and instructions. 3. Capability inventory: The skill utilizes the BrowserAct CLI for browser interaction and task execution. 4. Sanitization: There are no instructions for sanitizing or validating the content retrieved from external sites.
Recommendations
- AI detected serious security threats
Audit Metadata