web-scraper-agent
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for Indirect Prompt Injection through its data enrichment and processing workflows.
- Ingestion points: Untrusted data is retrieved from external websites via scraping tools (Requests, Crawlee, Apify, Firecrawl) and then passed to the
enrich_with_llmfunction for analysis. - Boundary markers: The prompt template in the
enrich_with_llmfunction interpolates scraped content directly using the{data[:5]}variable without employing delimiters (like XML tags, triple backticks, or specific instructions to ignore embedded commands) to separate data from instructions. - Capability inventory: The agent possesses several powerful capabilities, including the ability to perform network requests, write to the local file system (CSV/JSON), and interact with external database APIs (Notion, Supabase).
- Sanitization: There is no evidence of filtering, escaping, or validation performed on the scraped content before it is processed by the language model, which could allow a malicious website to influence the agent's behavior.
Audit Metadata