oauth-helper
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection by ingesting and acting upon content from external, potentially untrusted login pages.
- Ingestion points: The agent is instructed to scan login pages for CSS selectors (e.g.,
.google-btn,input#password) and URL patterns to determine which login flow to execute (SKILL.md). - Boundary markers: The skill lacks explicit prompt-level delimiters or instructions to ignore embedded malicious text within the login pages it processes, relying instead on manual Telegram confirmation.
- Capability inventory: The skill utilizes powerful browser automation capabilities, including navigation, element selection/clicking, and text input for credentials and two-factor authentication codes.
- Sanitization: There is no evidence of sanitization or structure validation for the external pages being processed; the agent blindly matches selectors which could be spoofed by a malicious site to trigger unintended credential-related actions.
Audit Metadata