crawlbrulee-scrape-async

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill references official infrastructure belonging to the author, including the domain crawlbrulee.com and the API endpoint api.crawlbrulee.com. The code examples use official software development kits (@crawlbrulee/sdk and crawlbrulee), which are appropriate for the documented functionality.
  • [SAFE]: Secrets such as the API key and webhook signing secret are correctly referenced as environment variables (CRAWLBRULEE_API_KEY and CRAWLBRULEE_WEBHOOK_SECRET) rather than being hardcoded, which is a standard security practice.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a scraping service that processes content from external websites, which is an inherent surface for indirect prompt injection if the scraped data contains malicious instructions meant for the AI agent.
  • Ingestion points: Data retrieved from external web pages via the url parameter in the scraping request (referenced in SKILL.md).
  • Boundary markers: Not explicitly defined in this technical documentation; the implementation relies on standard API response handling.
  • Capability inventory: The skill uses network communication to interact with the CrawlBrulee API and retrieve job results.
  • Sanitization: The skill provides detailed instructions for verifying webhook signatures to ensure data authenticity, though it does not specify sanitization of the scraped HTML or Markdown content itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 07:50 PM