scrapling

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the scrapling package from PyPI and execute scrapling install to set up the necessary browser binaries (Playwright/Chromium) for dynamic and stealth fetching.
  • [COMMAND_EXECUTION]: The skill utilizes CLI commands such as scrapling extract for performing web scraping operations and saving results to local files.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process data from arbitrary external websites.
  • Ingestion points: Data is fetched via Fetcher.get, DynamicFetcher.fetch, and StealthyFetcher.fetch (SKILL.md).
  • Boundary markers: The instructions do not define specific delimiters or security headers to isolate scraped content from the agent's control flow.
  • Capability inventory: The agent has capabilities to execute shell commands (scrapling), write files to disk, and perform network requests.
  • Sanitization: There are no explicit sanitization steps defined for the extracted content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 07:22 AM
Security Audit — agent-trust-hub — scrapling