ebay-hardware-hunter

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from eBay listing titles and summaries. If a seller includes malicious instructions in a listing title, the agent might be influenced when scoring or reporting the deal.
  • Ingestion points: The itemSummaries array from the eBay Browse API, specifically the title field, is ingested into the agent's context for scoring and reporting.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt logic.
  • Capability inventory: The skill uses npx zapier-sdk to execute shell commands, perform network operations via curl, and write data to Zapier Tables.
  • Sanitization: While the skill uses an EXCLUDE list for relevance filtering (e.g., skipping 'box only' listings), it does not perform sanitization for prompt injection patterns.
  • [COMMAND_EXECUTION]: The skill's primary operation involves executing shell commands via the Zapier SDK CLI (npx zapier-sdk). This includes performing network requests, managing authentication, and interacting with database tables.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @zapier/zapier-sdk and @zapier/zapier-sdk-cli packages from the NPM registry. These are official packages from Zapier, a well-known service provider.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:06 PM
Security Audit — agent-trust-hub — ebay-hardware-hunter