crw-self-host
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download installation scripts and binaries from the vendor's official domain (
fastcrw.com) and GitHub Container Registry (ghcr.io/us/crw). - Evidence includes shell script downloads via
curl -fsSL https://fastcrw.com/installand GPG key retrieval for the APT repository. - The Python SDK (
pip install crw) is documented to automatically download a binary component upon its first execution. - [COMMAND_EXECUTION]: The skill documentation includes high-privilege commands and direct execution of remote scripts.
- It describes piping a remote script directly into a shell:
curl -fsSL https://fastcrw.com/install | sh. - It includes commands using
sudoto configure system-level software repositories and install packages viaapt. - [PROMPT_INJECTION]: The skill facilitates an Indirect Prompt Injection surface (Category 8).
- Ingestion points: The tool is designed to scrape and crawl external URLs, bringing untrusted web content into the agent's context in markdown or JSON formats.
- Capability inventory: The skill enables network operations (scraping), local file reading (via the
Readtool for config), and potentially LLM-based extraction using configured API keys. - Boundary markers: While the tool provides structured output, the resulting text from external sites is passed back to the agent without guaranteed sanitization against embedded instructions.
- Sanitization: The skill relies on the user to configure LLM extraction parameters and hardening (e.g., PDF sandboxing), but raw scraped content remains an injection vector.
Audit Metadata