scraperapi-agent-onboarding

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill demonstrates secure handling of sensitive data by instructing users to use environment variables (e.g., export SCRAPERAPI_API_KEY) and .env files for API key storage.
  • [EXTERNAL_DOWNLOADS]: The skill references multiple vendor-owned dependencies and resources necessary for its operation:
  • Python packages: scraperapi-mcp-server, scraperapi-sdk.
  • Node.js package: scraperapi-sdk.
  • Remote MCP endpoint: https://mcp.scraperapi.com/mcp.
  • [COMMAND_EXECUTION]: The skill provides standard integration commands, including the use of npx mcp-remote to connect to a remote MCP server and curl for initial API connectivity testing. These operations are restricted to vendor-controlled infrastructure.
  • [PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied URLs and search queries for web scraping. While this ingestion of untrusted data constitutes a surface for indirect prompt injection, it is the primary intended function of the scraping service and is explicitly documented in the skill description.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 08:27 PM
Security Audit — agent-trust-hub — scraperapi-agent-onboarding