scrape
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
bdataCLI (Bright Data's official tool) for web scraping tasks. It also uses standard shell utilities such asxargs,bash,grep,md5sum, andtestto manage scraping loops, parallelization, and output verification. - [EXTERNAL_DOWNLOADS]: The skill uses
bdata scrapeto download content from arbitrary URLs provided by the user. While this involves fetching external data, it is the fundamental purpose of a scraping skill. It also provides a legacycurlfallback that connects toapi.brightdata.com(the vendor's official API endpoint). - [INDIRECT_PROMPT_INJECTION]: As a scraping skill, it inherently ingests untrusted data from the web. The skill implements a verification gate that inspects the output for common block pages (e.g., Cloudflare, CAPTCHAs) and expects specific markers (like headings or price patterns) before declaring success, which provides a layer of sanitization against malicious or malformed web content. The primary ingestion point is the output of
bdata scrape, and the output is often intended for LLM consumption (e.g.,-f markdown). Boundary markers are not explicitly defined in the provided shell scripts but are part of the broader agent-tool interface. - [SAFE]: The use of
bdata loginandbdata login --deviceare standard authentication procedures for the Bright Data CLI. TheBRIGHTDATA_API_KEYis referenced as an environment variable for the legacy path, which follows safe credential management practices by avoiding hardcoded secrets.
Audit Metadata