scraperapi-scraper-builder
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from external, user-defined target websites via the ScraperAPI service during its reconnaissance phase to analyze site architecture.
- [DATA_EXFILTRATION]: As part of its core scraping functionality, the skill transmits target URLs and queries to the vendor's infrastructure at api.scraperapi.com and async.scraperapi.com.
- [PROMPT_INJECTION]: The skill is subject to an indirect prompt injection surface because it processes untrusted HTML content from external websites.
- Ingestion points: Target website HTML fetched during the Phase 2 reconnaissance probe.
- Boundary markers: No specific boundary markers are used when analyzing the scraped HTML for selectors.
- Capability inventory: The agent context allows for network requests to ScraperAPI endpoints.
- Sanitization: No explicit sanitization or filtering of the fetched HTML content is performed before analysis.
- [SAFE]: The skill follows security best practices by instructing users to use environment variables (SCRAPERAPI_API_KEY) for credentials and by utilizing standard libraries such as requests, beautifulsoup4, node-fetch, and commander.
Audit Metadata