webextrator
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill sends user-provided URLs to
https://api.acedata.cloud/for rendering and extraction. This is the intended core function of the skill and targets the vendor's official domain. - [EXTERNAL_DOWNLOADS]: The documentation references the installation of
mcp-webextratorvia pip. This package is an official resource provided by the author 'acedatacloud'. - [SAFE]: The skill follows security best practices by instructing users to manage sensitive API tokens using environment variables within a
.envfile rather than hardcoding them into scripts. - [PROMPT_INJECTION]: While the skill ingests untrusted data from arbitrary web pages (indirect injection surface), this is inherent to its purpose as a web scraper. The data is returned in a structured format, and the extraction logic is managed via the vendor's API, which mitigates direct execution risks.
Audit Metadata