ebay-hardware-hunter
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from eBay listing titles and summaries. If a seller includes malicious instructions in a listing title, the agent might be influenced when scoring or reporting the deal.
- Ingestion points: The
itemSummariesarray from the eBay Browse API, specifically thetitlefield, is ingested into the agent's context for scoring and reporting. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt logic.
- Capability inventory: The skill uses
npx zapier-sdkto execute shell commands, perform network operations viacurl, and write data to Zapier Tables. - Sanitization: While the skill uses an
EXCLUDElist for relevance filtering (e.g., skipping 'box only' listings), it does not perform sanitization for prompt injection patterns. - [COMMAND_EXECUTION]: The skill's primary operation involves executing shell commands via the Zapier SDK CLI (
npx zapier-sdk). This includes performing network requests, managing authentication, and interacting with database tables. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@zapier/zapier-sdkand@zapier/zapier-sdk-clipackages from the NPM registry. These are official packages from Zapier, a well-known service provider.
Audit Metadata