scrape-scrapy-cloud
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uvx shubto execute Scrapy Cloud operations. This is a standard practice for Python-based CLI tools to ensure the environment is correctly set up without manual installation. - [EXTERNAL_DOWNLOADS]: The skill fetches the
shubCLI tool dynamically usinguvxand queries the Docker Hub API (https://hub.docker.com/v2/repositories/scrapinghub/scrapinghub-stack-scrapy/tags) to determine the appropriate Scrapy stack version. These are well-known and trusted technology services. - [DATA_EXFILTRATION]: While the skill communicates with
app.zyte.comandstorage.zyte.com, these operations are the primary purpose of the skill (deploying spiders and fetching logs/items). The skill includes explicit instructions and a dedicated script (scripts/scrapy_cloud_api.py) designed to prevent the accidental exposure of API keys in command outputs or agent logs. - [CREDENTIALS_UNSAFE]: The skill manages authentication via
SHUB_APIKEYand standard configuration files (~/.scrapinghub.yml). It does not hardcode any secrets and follows best practices by using an internal wrapper script to inject headers safely.
Audit Metadata