scraperapi-agent-onboarding
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure handling of sensitive data by instructing users to use environment variables (e.g.,
export SCRAPERAPI_API_KEY) and.envfiles for API key storage. - [EXTERNAL_DOWNLOADS]: The skill references multiple vendor-owned dependencies and resources necessary for its operation:
- Python packages:
scraperapi-mcp-server,scraperapi-sdk. - Node.js package:
scraperapi-sdk. - Remote MCP endpoint:
https://mcp.scraperapi.com/mcp. - [COMMAND_EXECUTION]: The skill provides standard integration commands, including the use of
npx mcp-remoteto connect to a remote MCP server andcurlfor initial API connectivity testing. These operations are restricted to vendor-controlled infrastructure. - [PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied URLs and search queries for web scraping. While this ingestion of untrusted data constitutes a surface for indirect prompt injection, it is the primary intended function of the scraping service and is explicitly documented in the skill description.
Audit Metadata