crawlberg-headless-fallback
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external web content which introduces an attack surface for indirect prompt injection if the resulting data is interpreted as instructions by an AI agent. * Ingestion points: The crawlberg scrape command (found in SKILL.md) fetches data from arbitrary external URLs. * Boundary markers: The instructions do not specify any delimiters or safety warnings to ignore embedded instructions within the scraped content. * Capability inventory: The tool performs network operations to fetch content and executes JavaScript in a headless browser environment. * Sanitization: Although the tool can format output as markdown, there are no mentions of specific sanitization or filtering to prevent adversarial instructions from affecting the agent.
- [COMMAND_EXECUTION]: The skill instructs the agent on how to execute the crawlberg CLI tool with various parameters. * Evidence: The documentation includes examples for running the scraper with different browser modes and connecting to external browser endpoints using WebSocket URLs (ws:// or wss://) via the --browser-endpoint flag in SKILL.md.
Audit Metadata