brightdata-sdk-js

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @brightdata/sdk package from the official NPM registry and connects to the vendor's infrastructure at brightdata.com and api.brightdata.com for data extraction tasks.
  • [CREDENTIALS_UNSAFE]: The SDK manages authentication through the BRIGHTDATA_API_TOKEN environment variable or an apiKey configuration option. The documentation guides users to handle these credentials securely.
  • [COMMAND_EXECUTION]: Instructions are provided for package installation using standard Node.js package managers. The SDK also includes a saveResults method for writing data to the local filesystem, which is necessary for its stated purpose.
  • [DATA_EXFILTRATION]: The skill's primary function is web scraping and search, which involves collecting data from external websites. This data is returned to the user or saved locally, while authentication tokens are transmitted to the vendor's API.
  • [PROMPT_INJECTION]: The skill ingests untrusted content from external websites, creating a surface for indirect prompt injection. This is an inherent risk of the skill's data-gathering functionality.
  • Ingestion points: client.scrapeUrl, client.scrape.., client.search., and client.discover methods.
  • Boundary markers: No explicit sanitization or delimiters are provided in the instructions to protect against instructions embedded in scraped content.
  • Capability inventory: The skill includes file-writing methods (saveResults) and browser automation control via client.browser.getConnectUrl.
  • Sanitization: The provided documentation does not detail any sanitization of the scraped content before it is passed to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 05:55 AM
Security Audit — agent-trust-hub — brightdata-sdk-js