crawl4ai

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes multiple examples that embed credentials directly into code and configs (cookies, proxy username/password, session passwords, and MCP env entries like "OPENAI_API_KEY": "your-key"), which would require an agent to output secret values verbatim if asked to populate those fields—creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs the agent to fetch and ingest arbitrary public webpages (e.g., AsyncWebCrawler.arun/arun_many, AdaptiveCrawler.digest, smart_crawl_url in the MCP examples and the RAG pipeline sections) and then uses that untrusted, user/third‑party content as input to LLM extraction and downstream decisions, so external pages can materially influence tool use and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP integration includes an npx invocation ("npx -y crawl4ai-mcp@latest") which will fetch and execute the crawl4ai-mcp package from the npm registry (see https://github.com/unclecode/crawl4ai-mcp), meaning external code is fetched and run at runtime and can provide tools that directly influence agent prompts/behavior.