scrape-zyte-login
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
sourceandpowershell -Fileto execute local scripts provided by the user. This is the intended mechanism for loading API keys into the environment from files downloaded during the setup process. - [EXTERNAL_DOWNLOADS]: The agent is instructed to open
https://app.zyte.com/agent-setupin the user's browser. This URL belongs to a well-known service (Zyte) and is used for its legitimate configuration flow. - [DATA_EXFILTRATION]: The instructions include a clear prohibition against displaying or echoing API keys in the transcript, mitigating the risk of accidental credential exposure in logs or session data.
- [COMMAND_EXECUTION]: The skill writes a project ID to a hidden configuration directory (
.scrape/.zyte/project-id). While this involves interpolation of user-supplied data, the instruction specifically limits this to numeric IDs, which is a standard configuration practice.
Audit Metadata