web-utilities-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local helper script (
scripts/crawlora.sh) to facilitate API interactions. The script is exceptionally well-hardened, featuring: - Strict validation of the
CRAWLORA_API_KEYformat to prevent injection attacks. - Secure credential handling using temporary, restricted-permission curl configuration files to avoid exposing keys in process lists.
- Explicit allowlisting of HTTP methods and API routes using regex to prevent unauthorized API access.
- Protections against local file disclosure via curl's
@syntax in both query parameters and request bodies. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites through its scraping and extraction features, which provides a potential surface for indirect prompt injection attacks.
- Ingestion points: Untrusted content enters the agent context via the output of
scripts/crawlora.shwhen calling the/web/scrapeand/extractendpoints. - Boundary markers: The skill instructions do not specify explicit delimiters or "ignore instructions" wrappers for the ingested content.
- Capability inventory: The skill can execute local shell commands and perform network requests to the
api.crawlora.netdomain. - Sanitization: The backend API provides sanitization by converting content to clean markdown and removing boilerplate, though semantic instructions may persist.
Audit Metadata