facebook-marketplace-runtime-setup
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the uv installation script from astral.sh, a well-known service for Python development tools.
- [REMOTE_CODE_EXECUTION]: Executes the uv installation script via shell piping and performs an editable tool installation of browser-harness from its repository.
- [COMMAND_EXECUTION]: Uses osascript to activate and navigate the local Chrome browser and modifies skill registry files (CLAUDE.md) to integrate the new functionality.
- [PROMPT_INJECTION]: Processes live browser text from Facebook Marketplace to verify session health, representing a potential surface for indirect prompt injection.
- Ingestion points: Scraped browser inner text from Facebook Marketplace pages via the browser-harness js helper.
- Boundary markers: None present in the data extraction script.
- Capability inventory: Shell command execution, tool installation, and configuration file modification.
- Sanitization: None present on the scraped content before it is processed by the agent.
Audit Metadata