data-scraper-agent
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements an architecture that fetches content from arbitrary public websites and passes it to an LLM for analysis, creating a potential surface for indirect prompt injection.\n
- Ingestion points: The
scraper/sources/source_name.pytemplate fetches data from untrusted external URLs or APIs using therequestslibrary.\n - Boundary markers: The prompt template in
ai/pipeline.pyuses markdown headers (e.g.,# Items,# Instructions) to separate scraped content from system instructions but lacks explicit isolation directives telling the LLM to ignore embedded commands within the scraped data.\n - Capability inventory: Scraped data is processed by the LLM and stored in database providers like Notion, Google Sheets, or Supabase. The agent does not directly execute code based on the LLM output.\n
- Sanitization: Ingested items are serialized via
json.dumps()before prompt interpolation, which prevents structural prompt breakage but does not filter out malicious natural language instructions.\n- [DATA_EXPOSURE]: The Gemini client implementation inai/client.pytransmits theGEMINI_API_KEYas a query parameter in the REST request URL (?key={api_key}). While this is a supported authentication method for the Google Generative Language API, it is a less secure practice than header-based authentication because URLs are more likely to be logged in server-side logs, proxy logs, or debugging outputs.
Audit Metadata