Security audit
Security checks for vulnerabilities and agentic risk
This skill is a basic public price-scraping helper with no hidden persistence or credential handling, but its documentation overstates what the included script actually does.
Install only if you want a lightweight helper for organizing already-scraped price data and guiding manual web extraction. Treat the advertised scraping, CSV, tracking, and currency-conversion features as incomplete, and ensure any scraping respects site terms, robots.txt, and permission boundaries.
The skill claims capabilities such as scraping major e-commerce sites, currency conversion, CSV output, and price tracking that are not actually implemented. This mismatch can mislead downstream agents or users into making decisions based on assumed functionality, and in security terms it obscures the real behavior and review surface of the skill.
The skill advertises and instructs use of network access and structured output generation, but it does not declare any explicit tool scope such as allowed-tools or permissions. Missing scope boundaries makes it easier for an agent runtime to over-grant capabilities or invoke this skill in broader contexts than intended, increasing the risk of unintended network access or file output behavior.
The activation description is broad enough to match many generic shopping, pricing, or product-related prompts, which can cause the skill to trigger outside narrowly intended scraping use cases. Over-broad triggering increases the chance of unnecessary network activity, unintended data handling, or misuse in contexts where users did not explicitly request scraping.
The module docstring says 'Product pricing scraper' and the CLI description repeats that framing, implying the script performs scraping. However, the implementation explicitly says scraping must be done by an external web_fetch or browser tool and only ingests JSON from stdin.
The manifest describes a skill that supports scraping Amazon, eBay, Walmart, and generic product pages, with price extraction and comparison. In this file, the code explicitly states it is a placeholder, instructs the user to use another tool for scraping, and merely reads pre-scraped JSON from stdin before formatting output.
No suspicious patterns detected.
