scrapfly-sdk-rust
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
scrapfly-sdkcrate, which is the official library for the Scrapfly service. - [COMMAND_EXECUTION]: The skill uses the
shot.savemethod to write screenshot data to the local file system, which is a core feature of the SDK. - [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing external web content through an AI extraction prompt.
- Ingestion points: Content retrieved from URLs in
ScrapeConfigand processed inExtractionConfig. - Boundary markers: None present in the provided examples.
- Capability inventory: Local file system writes (
shot.save) and network requests to target URLs and the Scrapfly API. - Sanitization: No sanitization of the scraped content is demonstrated before it is passed to the extraction engine.
- [CREDENTIALS_UNSAFE]: The instructions recommend using environment variables (
SCRAPFLY_API_KEY) for API key management, which is a safe practice.
Audit Metadata