web-unblocker
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation provides multiple examples using
curlto interact with the service endpoint atunblock.oxylabs.io. These examples include the-kflag to bypass SSL verification, which is documented as a requirement for the proxy service to function with its own certificates. - [DATA_EXFILTRATION]: All network operations are directed to the vendor's infrastructure at
oxylabs.io. Authentication credentials for the service are managed via environment variables ($OXYLABS_USERNAME,$OXYLABS_PASSWORD) to avoid accidental exposure in the code or instructions. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates web scraping, which introduces a surface for indirect prompt injection from processed web content.
- Ingestion points: Examples in
examples.mddemonstrate fetching content from user-specified external URLs. - Boundary markers: The instructions do not define specific delimiters to separate scraped content from agent instructions.
- Capability inventory: The skill leverages network request capabilities to retrieve external data.
- Sanitization: The provided code examples do not include logic to filter or sanitize the retrieved content.
Audit Metadata