Gen Agent Trust Hub

The skill facilitates lead generation via web scraping but introduces several security risks. It constructs shell commands dynamically from user-provided input, which could allow for command injection. It also reads sensitive credentials from a local .env file and passes them through shell pipes, and it depends on an external NPM package from a non-pre-approved source. Furthermore, it lacks sanitization for data scraped from social media platforms, creating a surface for indirect prompt injection.

The provider classified the analyzed snapshot as MEDIUM risk. This result applies to the content available at audit time.