crawl4ai-web-crawler

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for initializing the environment and verifying the installation through commands like crawl4ai-setup and crawl4ai-doctor. It also includes commands for managing the Playwright browser dependency.- [EXTERNAL_DOWNLOADS]: The skill installs the crawl4ai package from the standard Python Package Index (PyPI) and downloads necessary browser binaries through the Playwright framework.- [CREDENTIALS_UNSAFE]: While the skill contains code examples requiring API tokens and proxy credentials, these are provided as clear placeholders (e.g., 'your-api-key', 'user:pass@proxy:8080'). The documentation also correctly references the use of environment variables for secret management.- [INDIRECT_PROMPT_INJECTION]: As a web crawling tool, the skill naturally ingests content from external, untrusted URLs. It processes this data using LLM extraction strategies, which constitutes a standard attack surface for indirect prompt injection. The skill includes content filtering strategies (Pruning and BM25) that can help mitigate noise in the ingested data.- [COMMAND_EXECUTION]: The CrawlerRunConfig allows for the execution of custom JavaScript code (js_code) within the browser context to handle dynamic pages. This is a standard and documented feature of the underlying library for web automation purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 04:16 AM
Security Audit — agent-trust-hub — crawl4ai-web-crawler