website-crawler-api
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from arbitrary external websites, which creates a surface for indirect prompt injection.
- Ingestion points: External content is fetched through the
url(Map/Crawl) andurls(Batch) parameters inSKILL.md. - Boundary markers: The instructions suggest using
markdownortextformats for LLM context, but the skill does not define specific boundary delimiters for the ingested content in its instructions. - Capability inventory: The skill performs network operations via the
requestslibrary and provided SDKs to interact with the crawler API. - Sanitization: The instructions do not specify sanitization or filtering of the content extracted from external sites.
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the
scaviolibrary viapipandnpm, and to run the@scavio/mcp-serverusingnpx. These resources are the official distribution tools for the service provided by the author. - [COMMAND_EXECUTION]: The skill documentation includes shell command examples for setting environment variables (
export) and installing software via package managers (pip,npm,npx).
Audit Metadata