scrapfly-sdk-typescript
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the official
scrapfly-sdkvia npm or JSR. These are legitimate library dependencies provided by the vendor for the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest and process content from external websites, which creates a surface for indirect prompt injection.
- Ingestion points: External content is fetched through
client.scrape()and processed viaclient.extract()inSKILL.md. - Boundary markers: No specific delimiters or instruction-bypass markers are included in the code examples.
- Capability inventory: The skill allows for network scraping and AI-based extraction of data from external sources.
- Sanitization: No explicit sanitization or filtering of the scraped content is performed before it is passed to the agent context.
Audit Metadata