scrape-scrapy-cloud

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uvx shub to execute Scrapy Cloud operations. This is a standard practice for Python-based CLI tools to ensure the environment is correctly set up without manual installation.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the shub CLI tool dynamically using uvx and queries the Docker Hub API (https://hub.docker.com/v2/repositories/scrapinghub/scrapinghub-stack-scrapy/tags) to determine the appropriate Scrapy stack version. These are well-known and trusted technology services.
  • [DATA_EXFILTRATION]: While the skill communicates with app.zyte.com and storage.zyte.com, these operations are the primary purpose of the skill (deploying spiders and fetching logs/items). The skill includes explicit instructions and a dedicated script (scripts/scrapy_cloud_api.py) designed to prevent the accidental exposure of API keys in command outputs or agent logs.
  • [CREDENTIALS_UNSAFE]: The skill manages authentication via SHUB_APIKEY and standard configuration files (~/.scrapinghub.yml). It does not hardcode any secrets and follows best practices by using an internal wrapper script to inject headers safely.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 09:07 AM
Security Audit — agent-trust-hub — scrape-scrapy-cloud