ebay-product-listings-scraper-api-skill

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:54 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a real eBay listing scraper, but it uses a third-party API and gives unsafe guidance that may lead users to paste an API key into chat.

Review before installing. Use this only for intentional eBay listing scraping through BrowserAct, and do not paste API keys into chat. Configure BROWSERACT_API_KEY locally through a protected environment variable or secret manager, and avoid sending sensitive search terms or business targets unless you are comfortable sharing them with BrowserAct.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19
• Finding: API Key Disclosure Through Agent Conversation< to get your Key." ``` ### Technical Analysis The instructions direct the Agent to ask the user to provide a reusable BrowserAct API key. Supplying a credential through an Agent conversation can expose it to conversation history, model context, telemetry, debugging records, or other logging systems. The credential only needs to be available to the local process through the `BROWSERACT_API_KEY` environment variable. Transmitting it through the conversation is therefore unnecessary and violates least-privilege and secret-handling principles. The script legitimately sends the API key as an HTTPS bearer token to the declared `api.browseract.com` service. The vulnerability is not that network transmission; it is the instruction encouraging the user to disclose the credential to the Agent before execution. ### Attack Path 1. The Skill checks whether `BROWSERACT_API_KEY` is configured. 2. If it is absent, the Skill instructs the Agent to ask the user to provide the key. 3. The user pastes the BrowserAct API key into the conversation. 4. The credential becomes part of Agent context or retained conversation and telemetry records. 5. A party with access to those records retrieves the reusable credential. 6. The exposed key is used to invoke BrowserAct operations under the victim's account until it is revoked or expires. ### Impact Assessment An attacker who obta ...[truncated 450 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the instruction to “ask and wait for the user to provide” the key with an instruction requiring local secret configuration. - Explicitly tell users never to paste API keys into Agent conversations. - Require users to set `BROWSERACT_API_KEY` through a protected shell environment, operating-system credential store, or secret manager. - Ensure that error messages, command output, and diagnostic logs never print the credential. - Recommend immediate key rotation if a credential has already been disclosed through chat. - Use narrowly scoped and short-lived credentials if BrowserAct supports them. A safer instruction would be: ```markdown If `BROWSERACT_API_KEY` is not configured, stop and ask the user to set it locally through a protected environment variable or secret manager. Never ask the user to paste the API key into the conversation. ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ebay_product_listings_scraper_api.py:95
• Finding: CLI Error Message Encourages Conversational API Key Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ebay_product_listings_scraper_api.py`, lines 95–102 **Vulnerability Type**: Plaintext credential disclosure guidance **Risk Level**: Medium ### Vulnerable Code Snippet ```python api_key = os.getenv("BROWSERACT_API_KEY") if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print(f"1. Go to: {API_KEY_URL}", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The missing-key error offers “Provide it to me” as an alternative to configuring an environment variable. In an Agent-operated Skill, this language encourages users to paste a reusable bearer credential into the conversation. The script already supports retrieving the secret from `BROWSERACT_API_KEY`, which is sufficient for its declared functionality. Conversational receipt of the key provides no necessary capability and expands the number of systems through which the credential may pass. The script does not print the value after reading it and sends it only as an authorization header to the fixed HTTPS endpoint `https://api.browseract.com/v3/bots`. No covert exfiltration endpoint was identified. The security issue is limited to the unsafe credential-onboarding message. ### Attack Path 1. A user runs the script without defining `BROWSERACT_API_KEY`. 2. The script prints a message suggesting that the user provide the API key to the Agent. 3. The user submits the credential in plaintext through the conversation. 4. The key may be retained in chat history, execution context, telemetry, or logs. 5. A party able to access those records recovers the key. 6. The party sends authenticated requests to BrowserAct using the victim's credential. ### Impact Assessment Successful exploitation can grant the attacke ...[truncated 379 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the phrase `Provide it to me or`. - Instruct the user to configure the key locally without displaying it in conversation or command output. - Prefer a secret manager or protected environment injection mechanism over plaintext command-line arguments. - Do not accept the API key as a positional command-line argument because process listings and shell histories may expose it. - Keep authorization headers out of logs and exception messages. - Document credential revocation and rotation procedures. For example: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print(f"Obtain a key from: {API_KEY_URL}", flush=True) print( "Set it locally as BROWSERACT_API_KEY using a protected environment " "or secret manager. Do not paste the key into a conversation.", flush=True, ) sys.exit(1) ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description contains broad invocation phrases like 'export public records', 'enrich datasets', and 'monitor public web data', which can cause the agent to select this skill for loosely related requests. Over-broad triggering increases the chance of unintended transmission of user prompts or targets to an external scraping service and can lead to unexpected network actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs use of an external BrowserAct API and asks for user-configured API credentials, but it does not warn users that their supplied inputs (such as keywords and marketplace URLs) will be sent to a third-party service. This creates a transparency and privacy risk because users may disclose sensitive targets or business queries without realizing they leave the local agent environment.

Missing User Warnings

Medium

• Confidence: 70% confidence
• Finding: The message tells the user to 'Provide it to me or set it as an environment variable,' which can encourage sharing a sensitive API key directly with an assistant or through insecure interfaces. Even though the script itself does not capture the key from stdin, this phrasing normalizes unsafe credential sharing and could lead to inadvertent exposure.

Static analysis

No suspicious patterns detected.