skills/brightdata/skills/scrape/Gen Agent Trust Hub

scrape

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the bdata CLI (Bright Data's official tool) for web scraping tasks. It also uses standard shell utilities such as xargs, bash, grep, md5sum, and test to manage scraping loops, parallelization, and output verification.
  • [EXTERNAL_DOWNLOADS]: The skill uses bdata scrape to download content from arbitrary URLs provided by the user. While this involves fetching external data, it is the fundamental purpose of a scraping skill. It also provides a legacy curl fallback that connects to api.brightdata.com (the vendor's official API endpoint).
  • [INDIRECT_PROMPT_INJECTION]: As a scraping skill, it inherently ingests untrusted data from the web. The skill implements a verification gate that inspects the output for common block pages (e.g., Cloudflare, CAPTCHAs) and expects specific markers (like headings or price patterns) before declaring success, which provides a layer of sanitization against malicious or malformed web content. The primary ingestion point is the output of bdata scrape, and the output is often intended for LLM consumption (e.g., -f markdown). Boundary markers are not explicitly defined in the provided shell scripts but are part of the broader agent-tool interface.
  • [SAFE]: The use of bdata login and bdata login --device are standard authentication procedures for the Bright Data CLI. The BRIGHTDATA_API_KEY is referenced as an environment variable for the legacy path, which follows safe credential management practices by avoiding hardcoded secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 04:30 PM