crawl
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the Tavily API (
api.tavily.com) to retrieve web data. This is a well-known service for AI-assisted search and crawling.- [COMMAND_EXECUTION]: The skill executes a local script./scripts/crawl.shto perform its operations. This script handles the crawling logic and output file management.- [PROMPT_INJECTION]: The skill ingests untrusted data from external websites via theurlparameter. This constitutes an indirect prompt injection surface as malicious instructions in crawled content could influence the agent's logic. - Ingestion points: External web content fetched from user-specified URLs.
- Boundary markers: None specified in the documentation for delimiting crawled content from agent instructions.
- Capability inventory: The skill possesses file writing capabilities and network access via the Tavily API.
- Sanitization: No sanitization or content validation procedures are mentioned for the ingested data.
Audit Metadata