scrapling-official
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content, creating a surface for indirect prompt injection attacks. It mitigations include the '--ai-targeted' flag and 'main_content_only' parameter, which automatically sanitize scraped content by stripping CSS-hidden elements, aria-hidden tags, HTML comments, and zero-width characters during conversion to Markdown.
- [EXTERNAL_DOWNLOADS]: The skill requires downloading external components, including the 'scrapling' Python package from PyPI and browser binaries via the library's install command. It also references official Docker images on GitHub Container Registry and Docker Hub.
- [COMMAND_EXECUTION]: The skill involves executing shell commands for installation and operation, such as CLI scraping tools and an MCP server for browser-based automation and session management.
Audit Metadata