crawlbrulee-scrape-async
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill references official infrastructure belonging to the author, including the domain
crawlbrulee.comand the API endpointapi.crawlbrulee.com. The code examples use official software development kits (@crawlbrulee/sdkandcrawlbrulee), which are appropriate for the documented functionality. - [SAFE]: Secrets such as the API key and webhook signing secret are correctly referenced as environment variables (
CRAWLBRULEE_API_KEYandCRAWLBRULEE_WEBHOOK_SECRET) rather than being hardcoded, which is a standard security practice. - [INDIRECT_PROMPT_INJECTION]: The skill describes a scraping service that processes content from external websites, which is an inherent surface for indirect prompt injection if the scraped data contains malicious instructions meant for the AI agent.
- Ingestion points: Data retrieved from external web pages via the
urlparameter in the scraping request (referenced inSKILL.md). - Boundary markers: Not explicitly defined in this technical documentation; the implementation relies on standard API response handling.
- Capability inventory: The skill uses network communication to interact with the CrawlBrulee API and retrieve job results.
- Sanitization: The skill provides detailed instructions for verifying webhook signatures to ensure data authenticity, though it does not specify sanitization of the scraped HTML or Markdown content itself.
Audit Metadata