website-crawler-api

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from arbitrary external websites, which creates a surface for indirect prompt injection.
  • Ingestion points: External content is fetched through the url (Map/Crawl) and urls (Batch) parameters in SKILL.md.
  • Boundary markers: The instructions suggest using markdown or text formats for LLM context, but the skill does not define specific boundary delimiters for the ingested content in its instructions.
  • Capability inventory: The skill performs network operations via the requests library and provided SDKs to interact with the crawler API.
  • Sanitization: The instructions do not specify sanitization or filtering of the content extracted from external sites.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the scavio library via pip and npm, and to run the @scavio/mcp-server using npx. These resources are the official distribution tools for the service provided by the author.
  • [COMMAND_EXECUTION]: The skill documentation includes shell command examples for setting environment variables (export) and installing software via package managers (pip, npm, npx).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 11:28 PM