The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a helper script scripts/scrapingant.sh used for installing the MCP server configuration into various clients (Claude, Cursor, VS Code, etc.) and performing diagnostics. These commands are limited to local configuration management and status checks.
[DATA_EXFILTRATION]: The skill communicates with the ScrapingAnt service at api.scrapingant.com to fetch web pages and check credit usage. This network activity is the primary intended function of the skill and targets the vendor's official API endpoints.
[CREDENTIALS_UNSAFE]: The skill utilizes a ScrapingAnt API key. It implements industry-standard security practices by instructing the user to store the key in an environment variable (SCRAPINGANT_API_KEY) rather than hardcoding it. The helper script further secures the key by masking it in output and passing it to network tools via standard input to avoid exposure in process listings.
[INDIRECT_PROMPT_INJECTION]: The skill fetches content from the live web, which represents an ingestion surface for untrusted data.
Ingestion points: Live web content fetched through the ScrapingAnt API and returned as Markdown in scripts/scrapingant.sh and the MCP tools.
Boundary markers: The skill instructions direct the agent to process the content as Markdown for RAG or summarization, effectively identifying the untrusted content block.
Capability inventory: The skill is configured with Bash, Read, Write, Edit, and WebFetch permissions to support its scraping and setup workflows.
Sanitization: The scrapingant.sh helper script uses curl's --data-urlencode to ensure that URLs and parameters provided as input are properly sanitized before being sent to the remote API.

scrapingant-web-fetch