scrape-webpage
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches webpage HTML, metadata, and image assets from user-provided URLs using Playwright. This is the core intended functionality of the skill.
- [COMMAND_EXECUTION]: Executes Node.js scripts to orchestrate browser automation and image processing. It also manages a headless Chromium browser instance via Playwright.
- [REMOTE_CODE_EXECUTION]: Provides instructions to install the 'playwright' and 'sharp' packages from the official npm registry and downloads browser binaries via 'npx playwright install chromium'. These are standard procedures for well-known development tools.
- [PROMPT_INJECTION]: As the skill ingests arbitrary data from external URLs (HTML, metadata, JSON-LD), it presents a surface for indirect prompt injection. This is addressed in the documentation with a specific warning to the agent to treat fetched content as untrusted and structurally clean the HTML to remove script and style tags.
- [DATA_EXFILTRATION]: The skill writes scraped data and downloaded images to a local output directory specified by the user. There is no evidence of unauthorized data transmission to third-party servers.
Audit Metadata