webextrator
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions a Python package 'mcp-webextrator' for tool-use, which is an expected extension of the vendor's service.
- [DATA_EXFILTRATION]: The skill documentation shows network requests to 'api.acedata.cloud'. As these target the vendor's own API infrastructure for the skill's primary purpose, they are considered safe.
- [CREDENTIALS_UNSAFE]: The documentation correctly instructs users to store the 'ACEDATACLOUD_API_TOKEN' in a
.envfile rather than hardcoding it, which is a standard security best practice. - [INDIRECT_PROMPT_INJECTION]: The skill processes external web content through scraping. While this is an attack surface, the documentation does not suggest auto-executing or unsafely interpolating this data in a way that bypasses agent safety guardrails.
- [COMMAND_EXECUTION]: The documentation includes standard
curlexamples for API interaction, which is typical for developer documentation.
Audit Metadata