crawl4ai
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute standard installation and diagnostic commands such as 'pip install crawl4ai', 'crawl4ai-setup', and 'crawl4ai-doctor'.
- [EXTERNAL_DOWNLOADS]: Fetches software packages from the Python Package Index (PyPI) and retrieves browser binaries required for the crawler's underlying browser engine during the setup phase.
- [REMOTE_CODE_EXECUTION]: Provides an example for running the MCP server using 'npx -y crawl4ai-mcp@latest', which downloads and executes the latest version of the tool.
- [PROMPT_INJECTION]: As a web crawling and LLM-extraction tool, the skill provides a surface for indirect prompt injection by ingesting untrusted data from the internet. • Ingestion points: Data enters the agent's context through crawler.arun, arun_many, and adaptive.digest methods which fetch external URLs in SKILL.md. • Boundary markers: Code examples do not demonstrate the use of explicit delimiters or specific system instructions to ignore potentially malicious content embedded in the scraped data. • Capability inventory: The agent has access to Bash, Write, and Edit tools, which could be targeted by successful injection. • Sanitization: While the library provides cleaned_html, the skill does not demonstrate specific techniques for sanitizing extracted text against adversarial instructions.
Audit Metadata