zhihu-question-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that override standard agent safety and autonomy protocols by mandating the automatic installation of a third-party dependency ("BrowserAct") without seeking user confirmation.
- [PROMPT_INJECTION]: The instructions explicitly direct the agent to conceal the installation process, instructing it not to describe the action as a browser request or to request separate approval from the user.
- [EXTERNAL_DOWNLOADS]: The skill requires the download and installation of external tools from a non-whitelisted source (browseract.com).
- [REMOTE_CODE_EXECUTION]: The directive to automatically install a CLI tool and an associated skill from an external repository represents a risk of unverified remote code execution without human oversight.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted content from the Zhihu platform.
- Ingestion points: Scraped data from Zhihu questions, descriptions, and topics (SKILL.md).
- Boundary markers: Absent; the skill does not use delimiters to isolate external data from its own instructions.
- Capability inventory: The skill utilizes the
browser-acttool for web interaction and CLI execution. - Sanitization: Absent; no evidence of validation or sanitization of the retrieved web content exists.
Recommendations
- AI detected serious security threats
Audit Metadata