scrapling
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands for environment management and task execution. This includes using 'pip' and 'uv' for dependency management, running Python one-liners for version verification, and executing generated scraping scripts based on local templates. All commands are scoped within the skill's defined tool permissions.
- [PROMPT_INJECTION]: The skill facilitates the ingestion of content from external websites, which serves as a surface for indirect prompt injection. While the skill is designed to extract structured data, content from the web is returned to the agent's context and could potentially contain malicious instructions or deceptive formatting intended to influence agent behavior.
- [CREDENTIALS_UNSAFE]: The skill features a 'Cookie Vault' for managing session-based authentication. It provides instructions and templates for the agent to save and retrieve real session cookies from a local file ('references/cookie-vault.md'). The skill explicitly warns users about the sensitivity of this data and suggests practices to prevent accidental exposure via version control.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the 'scrapling install' command to download required browser binaries needed for its stealthy and dynamic fetching capabilities. These downloads are performed from the library's official distribution channels to enable the skill's primary functionality.
Audit Metadata