scraperapi-price-monitoring
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from external product pages on Amazon, Walmart, and Google Shopping. This creates a surface for indirect prompt injection where malicious instructions embedded in product titles or descriptions could influence the agent during report generation. \n
- Ingestion points: Tool outputs and curl responses containing product titles and descriptions from external retailers. \n
- Boundary markers: Data is structured into markdown tables via the price-report-template.md. \n
- Capability inventory: Bash tool usage for curl requests and file system access for baseline storage. \n
- Sanitization: No explicit filtering or sanitization of external product data is mentioned before rendering it into the markdown report. \n
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute curl commands for interacting with the ScraperAPI service. This is a primary function of the skill and targets the vendor's own API infrastructure. Commands are well-defined and rely on user-provided API keys stored in environment variables.
Audit Metadata