web-unblocker

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The documentation provides multiple examples using curl to interact with the service endpoint at unblock.oxylabs.io. These examples include the -k flag to bypass SSL verification, which is documented as a requirement for the proxy service to function with its own certificates.
  • [DATA_EXFILTRATION]: All network operations are directed to the vendor's infrastructure at oxylabs.io. Authentication credentials for the service are managed via environment variables ($OXYLABS_USERNAME, $OXYLABS_PASSWORD) to avoid accidental exposure in the code or instructions.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates web scraping, which introduces a surface for indirect prompt injection from processed web content.
  • Ingestion points: Examples in examples.md demonstrate fetching content from user-specified external URLs.
  • Boundary markers: The instructions do not define specific delimiters to separate scraped content from agent instructions.
  • Capability inventory: The skill leverages network request capabilities to retrieve external data.
  • Sanitization: The provided code examples do not include logic to filter or sanitize the retrieved content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 12:54 PM
Security Audit — agent-trust-hub — web-unblocker