web-content-fetcher
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from arbitrary external URLs, which acts as a vector for indirect prompt injection.
- Ingestion points: The skill fetches content from the web via the Jina Reader API and the
scraplinglibrary withinscripts/fetch.py. - Boundary markers: There are no explicit delimiters or protective instructions used to isolate the fetched external content from the agent's primary instructions.
- Capability inventory: The skill maintains capabilities for network access and local script execution.
- Sanitization: While the skill converts HTML to Markdown, this process does not filter out natural language instructions that could influence the agent's behavior.
- [COMMAND_EXECUTION]: The skill utilizes a shell execution pattern in
SKILL.md(exec: python3 scripts/fetch.py <url>) that directly incorporates a user-supplied URL as a command-line argument. This creates a surface for command injection if the execution environment does not adequately sanitize shell metacharacters. - [EXTERNAL_DOWNLOADS]: The skill's operational setup involves the
scrapling installcommand, which downloads browser binaries and related dependencies from external remote servers.
Audit Metadata